Overview

overview

10

Static

static

bbb47e5703...ec.xls

windows7_x64

10

bbb47e5703...ec.xls

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bbb47e57037acd2f1d74101614c715c4ab9d7f294fa138953bc9823c8e16c7ec
  • Size 161KB
  • Sample210527-2a43nrn1fa
  • SHA256 bbb47e57037acd2f1d74101614c715c4ab9d7f294fa138953bc9823c8e16c7ec
  • MD5 SHA1 SHA512
Score
10/10
trickbotrob120bankertrojan

Malware Config

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    https://seiurksia.xyz/xls/bomb/index/processingSetRequestDownloadPayloader/?servername=excel

Extracted

Family

  • trickbot

Version

  • 100017

Botnet

  • rob120

C2

  • 178.72.192.20:443

  • 103.124.145.98:443

  • 45.5.152.39:443

  • 114.7.240.222:443

  • 85.248.1.126:443

  • 94.183.237.101:443

  • 146.196.121.219:443

  • 89.37.1.2:443

  • 94.142.179.77:443

  • 177.221.39.161:443

  • 85.175.171.246:443

  • 103.12.160.164:443

  • 180.178.106.50:443

  • 94.142.179.179:443

  • 46.209.140.220:443

  • 123.231.149.122:443

  • 123.231.149.123:443

  • 182.160.116.190:443

  • 131.0.112.122:443

  • 116.0.6.110:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target
      bbb47e57037acd2f1d74101614c715c4ab9d7f294fa138953bc9823c8e16c7ec
    • Size 161KB
    • SHA256 bbb47e57037acd2f1d74101614c715c4ab9d7f294fa138953bc9823c8e16c7ec
    • MD5 SHA1 SHA512
    Score
    10/10
    trickbotrob120bankertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks