General
-
Target
inv-1493703164-725307606.zip
-
Size
119KB
-
Sample
210309-12q3rd23me
-
MD5
db40a2c39239954e33a84f61b8a26ad6
-
SHA1
69f690732709b5a47c66ff39a9ede964eaf10678
-
SHA256
a312bea6a6445ae94dd24a17279f86ba6bc2148ebe471fbe122c99a939c698a4
-
SHA512
531898cf3926965104d386b50171115bb5ca6bba322b9e0c0bab03ca17392ee05eb12d194ac9f9c25be4fddb561726e71d68ca03fa62060fc8c423f932c3bac1
Static task
static1
Behavioral task
behavioral1
Sample
inv-1493703164-725307606.xls
Resource
win7v20201028
Malware Config
Extracted
http://gogorv.net/parseopml/intel.php
Extracted
trickbot
100013
rob72
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
-
autorunName:pwgrab
Targets
-
-
Target
inv-1493703164-725307606.xls
-
Size
192KB
-
MD5
0b2764b61bb52fcec1b44653bde9d050
-
SHA1
cce7efebaa8d0a3b818e9afc0a5cc2c537574aa6
-
SHA256
d8f85a2b411d50a6337b7cfa4604541e8d5df93dc2f35be4a31689d8310ae4c6
-
SHA512
3042c4b31da5663e60c15dc1d20a48ef883c3de4393db37b85243b194c3a66fda6d510ac0fbf469dcd7b448e89617450276ed04d760a2f47bfa287e66fcbdc9b
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-