Overview

overview

10

Static

static

8

120 seconds - Win. 10

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    upl_confirm.xls

  • Size

    172KB

  • Sample

    210302-nxhnh5466n

  • MD5

    00ce55ad01abf387d18d0cf962d1e52e

  • SHA1

    e8fb80ea421bbcb8514264320958db9ddea66e00

  • SHA256

    2149ef3da4386486a6d3e1a35faa79353bd9e0ee0142447cb3e8a34a9f5ddb02

  • SHA512

    c2e167071b29c2eadb06735aebc5eb749d5a0f3c5d65a073b7c02904cb436ee29f237da95f4851e32f631f94bf76211333dc1a291098baf3d0d92e429cede365

Score
10/10
trickbotrob21bankermacrotrojanxlm

Malware Config

Extracted

Family

trickbot

Version

2000026

Botnet

rob21

C2

154.79.252.132:449

179.191.108.58:449

200.6.169.124:443

103.76.20.226:443

80.78.77.116:449

80.78.75.246:443

45.234.248.66:449

187.190.116.59:443

185.234.72.84:443

36.94.202.131:443

103.91.244.102:449

168.232.188.88:449

103.73.101.98:449

173.81.4.147:449

202.142.151.190:449

118.67.216.238:449

108.170.20.72:443

85.159.214.61:443

36.92.93.5:449

79.122.166.236:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target

      upl_confirm.xls

    • Size

      172KB

    • MD5

      00ce55ad01abf387d18d0cf962d1e52e

    • SHA1

      e8fb80ea421bbcb8514264320958db9ddea66e00

    • SHA256

      2149ef3da4386486a6d3e1a35faa79353bd9e0ee0142447cb3e8a34a9f5ddb02

    • SHA512

      c2e167071b29c2eadb06735aebc5eb749d5a0f3c5d65a073b7c02904cb436ee29f237da95f4851e32f631f94bf76211333dc1a291098baf3d0d92e429cede365

    Score
    10/10
    trickbotrob21bankertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks