MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c9e3cfb53217e1838c60deba9f8b40e6cae60c8155a7ed8cc6344ab04beefa7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentBuilder

Vendor detections: 8

Maldoc score: 5

Intelligence 8 IOCs YARA 7 File information Comments

SHA256 hash:	6c9e3cfb53217e1838c60deba9f8b40e6cae60c8155a7ed8cc6344ab04beefa7
SHA3-384 hash:	609a467446c7b068df5ed84ea6dc2ff35d1200b432c00b81de7f9c5ed9e9264d87a3c9d786a8ac94d300f03d21f3dfbd
SHA1 hash:	bfb8d8db3c3b64d04ae77f8943c6c0cb10809f1a
MD5 hash:	7500c42100f4998290e543d5889b5e28
humanhash:	carolina-whiskey-march-potato
File name:	SecuriteInfo.com.Heur.27256.32226
Download:	download sample
Signature	SilentBuilder Create hunting rule
File size:	197'120 bytes
First seen:	2021-03-09 01:58:18 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/vnd.ms-excel
ssdeep	6144:GKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgE7unxkdmFInRbsYEK5sesX6:k7uemORblEK5Yq
TLSH	3D149C1A76BABB51D594073034E3CFD3A333EC26AA624646F53FB2371FB4590590A13A
Reporter	SecuriteInfoCom
Tags:	SilentBuilder

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 5

Application name is Microsoft Excel

Office document is in OLE format

OLE dump

MalwareBazaar was able to identify 3 sections in this file using oledump:

Section ID	Section size	Section name
1	4096 bytes	DocumentSummaryInformation
2	4096 bytes	SummaryInformation
3	186275 bytes	Workbook

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Auto_Open	Runs when the Excel Workbook is opened
Suspicious	EXEC	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Heur.27256.32226

Verdict:

Malicious activity

Analysis date:

2021-03-09 02:04:40 UTC

Tags:

macros ta505 loader

Link:

https://app.any.run/tasks/1620750b-a9ca-4666-84f1-6af81cf838ff

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

True

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/123070/

Detection(s):

SecuriteInfo.com.Heur.27256.32226.UNOFFICIAL

TwinWave.EvilDoc.Excel4DragoTrainingMontage.20210204.UNOFFICIAL

TwinWave.EvilDoc.QakySoWacky.M2.20210218.UNOFFICIAL

TwinWave.EvilDoc.QakySoWacky.M3.20210301.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Creating a file

Creating a process with a hidden window

Sending an HTTP GET request

Launching a process by exploiting the app vulnerability

Result

Verdict:

Malicious

File Type:

Legacy Office File

Link:

https://app.docguard.net/6c9e3cfb53217e1838c60deba9f8b40e6cae60c8155a7ed8cc6344ab04beefa7/results/dashboard

Payload URLs

URL

File name

http://www.iec.ch

WorkBook

Document image

Image:

Download PNG

Result

Threat name:

Hidden Macro 4.0

Detection:

malicious

Classification:

expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/632202

Signature

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Drops PE files to the user root directory

Found abnormal large hidden Excel 4.0 Macro sheet

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Behaviour

Behavior Graph:

Download SVG

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nspdz62tef7bqoggbxv2t6fubzwk4ygicvnh5wgmmnckwbf656tq._file

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:rob72 banker trojan

Link:

https://tria.ge/reports/210309-as8qlp6kbe/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Looks up external IP address via web service

Loads dropped DLL

Templ.dll packer

Process spawned unexpected child process

Trickbot

Malware Config

C2 Extraction:

103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449

Dropper Extraction:

http://gogorv.net/parseopml/intel.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6c9e3cfb53217e1838c60deba9f8b40e6cae60c8155a7ed8cc6344ab04beefa7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Excel_Hidden_Macro_Sheet Create hunting rule

Rule name:	multiple_concats_in_excel4_enjoy_the_silence Create hunting rule
Author:	Will Metcalf
Description:	Behold The Great And Powerful Match Iterator. Multiple Concats with register Function SILENT BUILDER EDITION
Reference:	https://www.youtube.com/watch?v=2sd7MQVofYc

Rule name:	multiple_concats_in_excel4_exec_enjoy_the_silence Create hunting rule
Author:	Will Metcalf
Description:	Behold The Great And Powerful Match Iterator. Multiple Concats with register Function SILENT BUILDER EDITION
Reference:	https://blog.reversinglabs.com/blog/excel-4.0-macros

Rule name:	multiple_concats_in_excel4_formula_exec_1 Create hunting rule
Author:	Will Metcalf
Description:	Behold The Great And Powerful Match Iterator. Multiple Concats Inside of exec Function
Reference:	https://blog.reversinglabs.com/blog/excel-4.0-macros

Rule name:	multiple_concats_in_excel4_formula_register Create hunting rule
Author:	Will Metcalf
Description:	Behold The Great And Powerful Match Iterator. Multiple Concats Inside of register Function
Reference:	https://blog.reversinglabs.com/blog/excel-4.0-macros

Rule name:	SUSP_Excel4Macro_AutoOpen Create hunting rule
Author:	John Lambert @JohnLaTwC
Description:	Detects Excel4 macro use with auto open / close

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/123070/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample