Rewterz Threat ALert – Trickbot Using Google Docs to Bypass Email Gateways

Severity

Medium

Analysis Summary

A phishing campaign using Google Docs links to evade email gateway detection and distribute TrickBot. The emails are sent via the legitimate Google Docs services, which means the content is a legitimate shared file notification from Google and contains only Google links. The message from the sender claims to be regarding a previously sent document that needs to be viewed. If a user falls for the lure, they are directed to a Google Docs file hosted on the genuine Google service. The content of the document is a fake 404 error and a link to an executable hosted on Google Drive. The file masquerades as a PDF in order to trick a user into opening it. If it is opened, it first creates a copy of itself in the ProgramData folder and an additional copy in a subfolder of the User AppData directory, which also contains the TrickBot configuration. Persistence is established via a scheduled task that executes the payload every 11 minutes. Finally, it hollows out svchost.exe to inject the malicious code. Additional svchost processes are continually spawned to run various TrickBot modules.

Impact

Security Bypass

Indicators of Compromise

IP(s) / Hostname(s)

• 107[.]181[.]175[.]122
• 181[.]129[.]93[.]226
• 186[.]47[.]40[.]234
• 190[.]152[.]4[.]210
• 198[.]27[.]74[.]146
• 200[.]119[.]45[.]140
• 79[.]143[.]31[.]94

URLs

• https[:]//docs[.]google[.]com/uc?id=112QLCdDtd4y-mAzr8hobCs0TP5mQmKfL
• https[:]//jaquetas01[.]cordenadorltda[.]org
• https[:]//services[.]halapar[.]org
• https[:]//docs[.]google[.]com/document/d/1fgSfd4DwReVKbcLI3ISO2jhX1Yn8WOqbXnmU_bg00_A/edit?usp=sharing_eip&ts=5d5accb1

Malware Hash (MD5/SHA1/SH256)

• ab2a8fc10e8c1a39ae816734db9480de
• 20328b1f169b1edeef38853dafbbacfdac53c66f7f1dd62f387091bedebfd497

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/attachments sent by unknown senders.