General
-
Target
boq_6_boq.doc
-
Size
684KB
-
Sample
200921-d7szzs4t26
-
MD5
4913959946c7c8d9ff682439eb108928
-
SHA1
2e77f1b7c588d274bd998dc6dda422363cc6f9ba
-
SHA256
052c9196dfe764f1fbd3850d706d10601235dc266d1151c93d34454a12206c28
-
SHA512
b74c1b001c628bc762eda6d724b674b8951380d8eb1e94fdfc59852b67e851b8ca670905e565467431c5c8b0282fe5f6c9f4ba8f0ce41840530959c13ce1c595
Static task
static1
Behavioral task
behavioral1
Sample
boq_6_boq.doc
Resource
win7v200722
Malware Config
Extracted
trickbot
1000513
ono76
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
-
autorunName:pwgrab
Targets
-
-
Target
boq_6_boq.doc
-
Size
684KB
-
MD5
4913959946c7c8d9ff682439eb108928
-
SHA1
2e77f1b7c588d274bd998dc6dda422363cc6f9ba
-
SHA256
052c9196dfe764f1fbd3850d706d10601235dc266d1151c93d34454a12206c28
-
SHA512
b74c1b001c628bc762eda6d724b674b8951380d8eb1e94fdfc59852b67e851b8ca670905e565467431c5c8b0282fe5f6c9f4ba8f0ce41840530959c13ce1c595
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-