Overview

overview

10

Static

static

8

Attach_589...70.xls

windows7_x64

10

Attach_589...70.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Attach_589256204_214472970.xls

  • Size

    141KB

  • Sample

    210224-998c949gda

  • MD5

    fa7354227422a339d34d662839e0aee2

  • SHA1

    09c5bb8db08c53f00745262ba414fa093d6dd7f9

  • SHA256

    d70803dc31e45825416b5391969ab9042baa17c01e080382a4340cef54090c84

  • SHA512

    48db1f5701e12f2e2cebc6aa852673d1a93598ed77c93dc6251270824fb11ac958315c8f3443edf2329c096b0149cdce48d94c30556113d9606df8856f5e8c43

Score
10/10
trickbotrob16bankermacrotrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://bearcatpumps.com.cn/css/tolkio.php

Extracted

Family

trickbot

Version

2000026

Botnet

rob16

C2

154.79.252.132:449

179.191.108.58:449

200.6.169.124:443

103.76.20.226:443

80.78.77.116:449

80.78.75.246:443

45.234.248.66:449

187.190.116.59:443

185.234.72.84:443

36.94.202.131:443

103.91.244.102:449

168.232.188.88:449

103.73.101.98:449

173.81.4.147:449

202.142.151.190:449

118.67.216.238:449

108.170.20.72:443

85.159.214.61:443

36.92.93.5:449

79.122.166.236:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      Attach_589256204_214472970.xls

    • Size

      141KB

    • MD5

      fa7354227422a339d34d662839e0aee2

    • SHA1

      09c5bb8db08c53f00745262ba414fa093d6dd7f9

    • SHA256

      d70803dc31e45825416b5391969ab9042baa17c01e080382a4340cef54090c84

    • SHA512

      48db1f5701e12f2e2cebc6aa852673d1a93598ed77c93dc6251270824fb11ac958315c8f3443edf2329c096b0149cdce48d94c30556113d9606df8856f5e8c43

    Score
    10/10
    trickbotrob16bankertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks