General
-
Target
Document_xxx.xlsm
-
Size
25KB
-
Sample
201228-vsdy3r36ee
-
MD5
bfbefd0c2003da4eaca02b8500f12cd5
-
SHA1
07e5796a4fdc3fc5b5e608020857c1d9f85bfa62
-
SHA256
6fb3d68ea64e29b3304a3885fb1ef3b3fffa27b2ce89ad40afcdda9572d8dcfe
-
SHA512
ba565cc77d75cfca02d05fea52ef9e7f82450137d060484ca0982ba03e076913d8816cab9f3cd872899dbb523ca247c1640c3bd00cfb70ad72cca38c998150c4
Static task
static1
Behavioral task
behavioral1
Sample
Document_xxx.xlsm
Resource
win7v20201028
Malware Config
Extracted
http://vermapaints.com/pic.gif
Extracted
trickbot
100007
rob32
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
Document_xxx.xlsm
-
Size
25KB
-
MD5
bfbefd0c2003da4eaca02b8500f12cd5
-
SHA1
07e5796a4fdc3fc5b5e608020857c1d9f85bfa62
-
SHA256
6fb3d68ea64e29b3304a3885fb1ef3b3fffa27b2ce89ad40afcdda9572d8dcfe
-
SHA512
ba565cc77d75cfca02d05fea52ef9e7f82450137d060484ca0982ba03e076913d8816cab9f3cd872899dbb523ca247c1640c3bd00cfb70ad72cca38c998150c4
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-