General
-
Target
435346.doc
-
Size
286KB
-
Sample
200828-b2nkxsa936
-
MD5
79947b3b8d3ee9e48d38f29ae35451f2
-
SHA1
af9a7c4dc0e9913fcd43d5c403f6dec606f2a384
-
SHA256
60d66df80e31a1604c9f1bcd1c4555148f5a1fd7b0ff5f411dcadf2c889032e1
-
SHA512
42c2112c6438a44ca028518f825c9ca9e3eeb98b7c0f014f5e5b03a14b7625817632b59accf74e75651a9791f8f74247b8f4c8ed914e8f83c5a4ac21355a7912
Static task
static1
Malware Config
Extracted
trickbot
1000513
chil103
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
-
autorunName:pwgrab
Targets
-
-
Target
435346.doc
-
Size
286KB
-
MD5
79947b3b8d3ee9e48d38f29ae35451f2
-
SHA1
af9a7c4dc0e9913fcd43d5c403f6dec606f2a384
-
SHA256
60d66df80e31a1604c9f1bcd1c4555148f5a1fd7b0ff5f411dcadf2c889032e1
-
SHA512
42c2112c6438a44ca028518f825c9ca9e3eeb98b7c0f014f5e5b03a14b7625817632b59accf74e75651a9791f8f74247b8f4c8ed914e8f83c5a4ac21355a7912
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Blacklisted process makes network request
-
Loads dropped DLL
-