Overview

overview

10

Static

static

8

Items_Pric...45.xls

windows7_x64

6

Items_Pric...45.xls

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Items_Pricerate20201345.xls
  • Size 79KB
  • Sample200707-vsv9h1kd2n
  • SHA256 eba7c4994a5cde3da749b4ebdb5e01ba0e675262198217b36f8cfd61daabae43
  • MD5 SHA1 SHA512
Score
10/10
trickbotchil60bankermacrospywaretrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 1000512

Botnet

  • chil60

C2

  • 95.171.16.42:443

  • 185.90.61.9:443

  • 5.1.81.68:443

  • 185.99.2.65:443

  • 134.119.191.11:443

  • 85.204.116.100:443

  • 78.108.216.47:443

  • 51.81.112.144:443

  • 194.5.250.121:443

  • 185.14.31.104:443

  • 185.99.2.66:443

  • 107.175.72.141:443

  • 192.3.247.123:443

  • 134.119.191.21:443

  • 85.204.116.216:443

  • 91.235.129.20:443

  • 181.129.104.139:449

  • 181.112.157.42:449

  • 181.129.134.18:449

  • 131.161.253.190:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      Items_Pricerate20201345.xls
    • Size 79KB
    • SHA256 eba7c4994a5cde3da749b4ebdb5e01ba0e675262198217b36f8cfd61daabae43
    • MD5 SHA1 SHA512
    Score
    10/10
    spywaretrojanbankertrickbot

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks