General
-
Target
Document_1640597299.xlsm
-
Size
25KB
-
Sample
201228-2zy9qdbkgs
-
MD5
9efd547705132fa1bd0514955e7dd0c6
-
SHA1
01e24f831c7a142f095d4014638d0bc72f72edbb
-
SHA256
970b0aa7e63d92972f1f0814b890c7c326e478fe8c971d95c3efe3f5d55ce4e7
-
SHA512
edec53862c48e837e8ab842111830a65fcbea7eb260eca4a675addc05251be3d0f6f1651ca145c4806ba377d88f4fb762b6a07e182a5641cf9fc3101469da3a8
Malware Config
Extracted
http://vermapaints.com/pic.gif
Extracted
trickbot
100007
rob32
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
Document_1640597299.xlsm
-
Size
25KB
-
MD5
9efd547705132fa1bd0514955e7dd0c6
-
SHA1
01e24f831c7a142f095d4014638d0bc72f72edbb
-
SHA256
970b0aa7e63d92972f1f0814b890c7c326e478fe8c971d95c3efe3f5d55ce4e7
-
SHA512
edec53862c48e837e8ab842111830a65fcbea7eb260eca4a675addc05251be3d0f6f1651ca145c4806ba377d88f4fb762b6a07e182a5641cf9fc3101469da3a8
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-