Overview

overview

10

Static

static

8

quicktime242777.doc

windows7_x64

10

quicktime242777.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    quicktime242777.doc
  • Size 761KB
  • Sample201023-hflamh7vqx
  • SHA256 0301ceff4ae136d0e349a096fdbb77617ac2d15e318a5846ccf52e91ecbaa2bc
  • MD5 SHA1 SHA512
Score
10/10
trickbotono92bankermacrotrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 2000014

Botnet

  • ono92

C2

  • 103.127.165.250:449

  • 103.109.78.174:449

  • 199.38.120.89:449

  • 103.206.128.121:449

  • 199.38.120.91:443

  • 199.38.121.150:443

  • 199.38.123.58:443

  • 208.86.162.215:443

  • 208.86.161.113:443

  • 208.86.162.241:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      quicktime242777.doc
    • Size 761KB
    • SHA256 0301ceff4ae136d0e349a096fdbb77617ac2d15e318a5846ccf52e91ecbaa2bc
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankertrickbot

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks