2019-06-25 Trickbot

ATTACHMENT:
(Information_Revealer_36300252.html)
2e9548b10f5c6c76417e63271025f1aa
498428706ac156f17dd06b94be660bff4e5cf5aba085d63d6582a57e5bb8a1de

-html contains encoded doc

(PurchaseOrder79584.docm)
5e8df695c4abd7b21fe185e264e7de07
f33266fb7f2a7c056b50b23ba8fe2d7841b25e6aef1bc060f0fb2f404a261ba6

-doc runs obfuscated jscript (info.pdf)
wscript.exe /e:JScript .\info.pdf

(info.pdf) - javascript
c81baee547e3791c95496536be9e8327
1b37c8f545cad2b7584bfe46edc3d7d803cf6d80d08633a9a30b05de699c4e87

script creates .hbo, decodes with certutil
%windir%\System32\certutil.exe -f -decode %TEMP%\251149.hbo %TEMP%\929464.exe

(929464.exe) signed payload
df8a69f3f7fab1fcb33225dc29cfbc47
3f651b525ceaa941c143b2adc3244b3d4b9af299ad09beea345867258dfbf5e7

"EITHAN CONSULTING LTD"
Serial Number	79 4C CA B4 3E 94 0D 1B 05 E0 5D A7 45 BE D0 FE

bot ID
sat53

gtag
1000440

c2
103.117.232[.]198:449
103.207.169[.]78:449
138.59.233[.]5:449
146.196.122[.]152:449
146.196.122[.]167:449
164.132.216[.]36:443
164.132.216[.]50:443
168.232.42[.]14:449
170.84.78[.]186:449
177.103.240[.]149:449
177.12.82[.]27:449
177.183.194[.]194:449
177.52.79[.]29:449
180.250.197[.]188:449
181.112.145[.]222:449
181.115.168[.]69:449
181.129.140[.]140:449
181.129.49[.]98:449
181.129.93[.]226:449
181.196.61[.]110:449
185.86.151[.]96:443
186.138.152[.]228:449
186.183.199[.]114:449
186.42.186[.]202:449
186.42.226[.]46:449
187.110.100[.]122:449
187.58.56[.]26:449
187.65.49[.]88:449
189.80.134[.]122:449
190.13.160[.]19:449
190.152.4[.]210:449
190.154.203[.]218:449
191.37.181[.]152:449
200.35.56[.]81:449
36.89.85[.]103:449
37.18.30[.]80:443
37.230.116[.]248:443
37.230.117[.]170:443
45.230.200[.]140:449
5.188.168[.]36:443
51.75.58[.]171:443
51.75.58[.]175:443
79.137.119[.]212:443
85.204.116[.]192:443
85.204.116[.]194:443
94.103.94[.]120:443