MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 10

Maldoc score: 23

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032
SHA3-384 hash:	39487981fb4f0506ca10309d824b1b01bee445386fc2a25fe54c537f41c10d63be4004ba2db5074d693daaae2ed41c9b
SHA1 hash:	9f286f77edda0ea0cdfd3fbd897b3e007974d30a
MD5 hash:	7bad9bfadd445f637abb738bba8000c7
humanhash:	one-louisiana-vermont-oranges
File name:	template-jn02b3.dot
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	56'320 bytes
First seen:	2021-06-03 09:16:50 UTC
Last seen:	2021-06-03 09:47:49 UTC
File type:	docx
MIME type:	application/msword
ssdeep	768:huuAWOOmKnnwOj+KCBbpCdOl2WDU7S+9mZRWAm8Wib2mkN:fIFCdN12WFgb
TLSH	B1435394A349DF1AD645383C9CCA9AB212269E43B83F00C7269D77DC9CB6C3CD7A0756
Reporter	abuse_ch
Tags:	docx dot rob96 TrickBot

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 23

Application name is Microsoft Office Word

Office document is in OLE format

Office document contains VBA Macros

OLE dump

MalwareBazaar was able to identify 10 sections in this file using oledump:

Section ID	Section size	Section name
1	160 bytes	CompObj
2	4096 bytes	DocumentSummaryInformation
3	4096 bytes	SummaryInformation
4	6416 bytes	1Table
5	369 bytes	Macros/PROJECT
6	41 bytes	Macros/PROJECTwm
7	29563 bytes	Macros/VBA/ThisDocument
8	2461 bytes	Macros/VBA/_VBA_PROJECT
9	477 bytes	Macros/VBA/dir
10	4096 bytes	WordDocument

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Document_Close	Runs when the Word document is closed
IOC	HelpCenterUpdater.vb	Executable file name
IOC	wscript.exe	Executable file name
Suspicious	Environ	May read system environment variables
Suspicious	Write	May write to a file (if combined with Open)
Suspicious	CreateTextFile	May create a text file
Suspicious	Shell	May run an executable file or a system command
Suspicious	WScript.Shell	May run an executable file or a system command
Suspicious	Run	May run an executable file or a system command
Suspicious	CreateObject	May create an OLE object
Suspicious	Chr	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Xor	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

641

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032.dot

Verdict:

Malicious activity

Analysis date:

2021-06-03 07:41:44 UTC

Tags:

macros macros-on-close generated-doc evasion

Link:

https://app.any.run/tasks/855eab1f-5101-40df-a8b2-3a89cd23bb0f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/vnd.openxmlformats-officedocument.wordprocessingml.document

Has a screenshot:

False

Contains macros:

True

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Result

Verdict:

Malicious

File Type:

Legacy Word File with Macro

Link:

https://app.docguard.net/fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032/results/dashboard

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Document With Few Pages

Document contains between one and three pages of content. Most malicious documents are sparse in page count.

Macro with File System Write

Detected macro logic that can write data to the file system.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Result

Threat name:

TrickBot

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/796541

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Benign windows process drops PE files

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA with hexadecimal encoded strings

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document exploit detected (creates forbidden files)

Document exploit detected (process start blacklist hit)

Drops PE files to the document folder of the user

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Found malware configuration

Machine Learning detection for sample

May check the online IP address of the machine

Microsoft Office drops suspicious files

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: WScript or CScript Dropper

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Windows Shell Script Host drops VBS files

Writes to foreign memory regions

Wscript called in batch mode (surpress errors)

Yara detected Trickbot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032/

Threat name:

Script-Macro.Trojan.Sadoca

Status:

Malicious

First seen:

2021-06-02 23:51:53 UTC

AV detection:

12 of 47 (25.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ucuqhnhjjwytlb4mdnzktupakufoepzvoxrf3pc2tsu5lyguaza._file

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:rob96 banker macro trojan xlm

Link:

https://tria.ge/reports/210603-p53t48kv9x/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Modifies system certificate store

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Drops file in Windows directory

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Process spawned unexpected child process

Trickbot

Malware Config

C2 Extraction:

196.43.106.38:443
186.97.172.178:443
37.228.70.134:443
144.48.139.206:443
190.110.179.139:443
172.105.15.152:443
177.67.137.111:443
27.72.107.215:443
186.66.15.10:443
189.206.78.155:443
202.131.227.229:443
185.9.187.10:443
196.41.57.46:443
212.200.25.118:443
197.254.14.238:443
45.229.71.211:443
181.167.217.53:443
181.129.116.58:443
185.189.55.207:443
172.104.241.29:443
14.241.244.60:443
144.48.138.213:443
202.138.242.7:443
202.166.196.111:443
36.94.100.202:443
187.19.167.233:443
181.129.242.202:443
36.94.27.124:443
43.245.216.116:443
186.225.63.18:443
41.77.134.250:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd05481da74a6d89ac3c60db954e8f02a85711f9abaf12ede2d4e54eaf06a032

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	SUSP_VBA_FileSystem_Access Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious VBA that writes to disk and is activated on document open
Reference:	Internal Research