General
-
Target
Document_1452730543.xls.zip
-
Size
35KB
-
Sample
201229-wxbn29s1xn
-
MD5
34a31f3585dad09d06303a44ef939525
-
SHA1
881eacc7ed44b2cdf8a8603e01f953977fbc3c3a
-
SHA256
cb9674fbcadf290724a4d48d36e6968195492c545f89679d010ad7b0e3676689
-
SHA512
daa65568955ce529b50cc5c325ba88e52faa82674683721bcad966c4f7137dc961e2778ae7f46f0fa7209c338707799fbc7e6f7588680065a6b183a26392aed4
Malware Config
Extracted
trickbot
100008
rob33
103.231.115.106:449
117.222.63.100:449
117.254.58.83:449
149.54.11.54:449
170.82.4.64:449
177.11.12.93:449
182.16.187.251:449
187.108.86.48:449
190.152.88.57:449
203.88.149.33:449
36.89.191.119:449
41.159.31.227:449
85.202.128.243:449
92.204.160.82:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
Document_1452730543.xls
-
Size
45KB
-
MD5
ff0c9c2a9193dab84e4f3fe426c56c54
-
SHA1
e4f5866918418e3c7b00bfcba16993b0eb1796cf
-
SHA256
8d8e5f67621739e6b1d56bcd0748949d35ecdcb9cbb903b298d351e0df1402cf
-
SHA512
80e2e32711481e0759a100648c6445f1c9e4a58a21f561833f7f0f819c98aba792561def14c64edd2335415b9ae4d2a62130fe31300edec38b4c71639fadcb83
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-