Rewterz Threat ALert – Trickbot Using Google Docs to Bypass Email Gateways

September 5, 2019

Severity

Medium

Analysis Summary

A phishing campaign using Google Docs links to evade email gateway detection and distribute TrickBot. The emails are sent via the legitimate Google Docs services, which means the content is a legitimate shared file notification from Google and contains only Google links. The message from the sender claims to be regarding a previously sent document that needs to be viewed. If a user falls for the lure, they are directed to a Google Docs file hosted on the genuine Google service. The content of the document is a fake 404 error and a link to an executable hosted on Google Drive. The file masquerades as a PDF in order to trick a user into opening it. If it is opened, it first creates a copy of itself in the ProgramData folder and an additional copy in a subfolder of the User AppData directory, which also contains the TrickBot configuration. Persistence is established via a scheduled task that executes the payload every 11 minutes. Finally, it hollows out svchost.exe to inject the malicious code. Additional svchost processes are continually spawned to run various TrickBot modules.

Impact

Security Bypass

Indicators of Compromise

IP(s) / Hostname(s)

107[.]181[.]175[.]122
181[.]129[.]93[.]226
186[.]47[.]40[.]234
190[.]152[.]4[.]210
198[.]27[.]74[.]146
200[.]119[.]45[.]140
79[.]143[.]31[.]94

URLs

https[:]//docs[.]google[.]com/uc?id=112QLCdDtd4y-mAzr8hobCs0TP5mQmKfL
https[:]//jaquetas01[.]cordenadorltda[.]org
https[:]//services[.]halapar[.]org
https[:]//docs[.]google[.]com/document/d/1fgSfd4DwReVKbcLI3ISO2jhX1Yn8WOqbXnmU_bg00_A/edit?usp=sharing_eip&ts=5d5accb1

Malware Hash (MD5/SHA1/SH256)

ab2a8fc10e8c1a39ae816734db9480de
20328b1f169b1edeef38853dafbbacfdac53c66f7f1dd62f387091bedebfd497

Remediation

Block all threat indicators at your respective controls.
Always be suspicious about emails sent by unknown senders.
Never click on the link/attachments sent by unknown senders.