General
-
Target
mon22.dll
-
Size
336KB
-
Sample
210122-a8rv21zbvx
-
MD5
c0436190368d55ecb656518b2d0410f2
-
SHA1
d889b4eaec46fbd5c0989c2e1cc33973415c256c
-
SHA256
50d488366ea4646148bd3fdd41cb31dbbc0ec24cf236c4b538fe0c07134a5073
-
SHA512
fd09857011030116e4b92292bced6ce5268c9d2fd784b15dc803dea4ca77dc5c9b63c40c754fa2ffbb40b35937f72a2da6352d69dea74679b808acf83954a731
Static task
static1
Behavioral task
behavioral1
Sample
mon22.dll
Resource
win7v20201028
Malware Config
Extracted
trickbot
100007
mon22
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
mon22.dll
-
Size
336KB
-
MD5
c0436190368d55ecb656518b2d0410f2
-
SHA1
d889b4eaec46fbd5c0989c2e1cc33973415c256c
-
SHA256
50d488366ea4646148bd3fdd41cb31dbbc0ec24cf236c4b538fe0c07134a5073
-
SHA512
fd09857011030116e4b92292bced6ce5268c9d2fd784b15dc803dea4ca77dc5c9b63c40c754fa2ffbb40b35937f72a2da6352d69dea74679b808acf83954a731
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-