General
-
Target
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
-
Size
631KB
-
Sample
220701-gj4ntagda8
-
MD5
a1fe38bb91804907360d23bbea35d242
-
SHA1
0d4fb2af132b6894ccea8fcaf567a59c504c2dc5
-
SHA256
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
-
SHA512
6a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
Static task
static1
Behavioral task
behavioral1
Sample
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0.exe
Resource
win7-20220414-en
Malware Config
Extracted
trickbot
1000474
ono20
51.68.247.62:443
37.228.117.146:443
91.132.139.170:443
37.44.212.216:443
31.184.253.37:443
51.254.69.244:443
194.5.250.82:443
5.230.22.40:443
185.222.202.222:443
46.30.41.229:443
203.23.128.168:443
190.154.203.218:449
189.80.134.122:449
200.116.199.10:449
181.113.20.186:449
187.58.56.26:449
146.196.122.167:449
177.103.240.149:449
181.199.102.179:449
200.21.51.38:449
181.49.61.237:449
190.152.4.210:449
138.59.233.5:449
36.89.85.103:449
45.161.33.88:449
186.42.185.10:449
170.233.120.53:449
187.110.100.122:449
200.153.15.178:449
186.42.98.254:449
181.129.93.226:449
186.42.226.46:449
190.13.160.19:449
186.183.199.114:449
170.84.78.117:449
190.152.4.98:449
181.196.61.110:449
138.185.25.228:449
200.35.56.81:449
186.42.186.202:449
185.70.182.162:449
91.207.185.73:449
181.129.49.98:449
181.115.168.69:449
-
autorunControl:GetSystemInfoName:systeminfoName:pwgrab
Targets
-
-
Target
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
-
Size
631KB
-
MD5
a1fe38bb91804907360d23bbea35d242
-
SHA1
0d4fb2af132b6894ccea8fcaf567a59c504c2dc5
-
SHA256
7985c469c8c0d0db2d09e1a378e3c9c85e19f12bb7a3daf194602fbde9fc6ec0
-
SHA512
6a3a8c1f3bfac9f4054070288146f639d94d7b386b8be57d760cd46dc3c076edaa7df4c9441b8c9b26816252707913212c3cb63e29acf2a4760876d2eef04a73
-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-