5-20-2018: #IcedID/#BokBot & #TrickBot “pir4” version 100019

I. First-Stage Loader:
request[.]doc (b72b2fd486fe10fac16e230e9058ee3c)
II. Second-Stage Loader (inject -> IcedID/BokBot):
hxxp://tagamol[.]com/chans[.]exe
III. Download and Execute:
hxxp://185[.]177[.]216[.]187/out/pir4[.]exe

TrickBot "pir4" -> "tt0002":
<mcconf>
   <ver>1000195</ver>
   <gtag>tt0002</gtag>
   <servs>
      <srv>2087511770:449</srv>
      <srv>9255251211:449</srv>
      <srv>11891178139:449</srv>
      <srv>9411252197:449</srv>
      <srv>17610021025:449</srv>
      <srv>1383429172:443</srv>
      <srv>209121142202:449</srv>
      <srv>5102177205:449</srv>
      <srv>209121142214:449</srv>
      <srv>9516118042:449</srv>
      <srv>20386222142:443</srv>
      <srv>4620207204:443</srv>
      <srv>689673154:449</srv>
      <srv>18542192194:449</srv>
      <srv>682273146:449</srv>
      <srv>10714449162:443</srv>
      <srv>467217517:449</srv>
      <srv>14448518:443</srv>
      <srv>46243179212:449</srv>
      <srv>8117725576:449</srv>
      <srv>18524925577:443</srv>
      <srv>8093182201:443</srv>
      <srv>3723011687:443</srv>
      <srv>2171073421:443</srv>
      <srv>217107346:443</srv>
      <srv>8214658155:443</srv>
      <srv>19554162116:443</srv>
      <srv>8087195247:443</srv>
      <srv>18517417242:443</srv>
      <srv>3746134142:443</srv>
      <srv>6210918210:443</srv>
   </servs>
   <autorun>
      <module name="systeminfo" ctl="GetSystemInfo" />
      <module name="injectDll" />
   </autorun>
</mcconf>

Plugin:
<psrv>185.159.129.149:447</psrv>
<psrv>82.202.236.81:447</psrv>
<psrv>185.228.233.169:447</psrv>
<psrv>85.143.214.133:447</psrv>
<psrv>185.174.172.226:447</psrv>
<psrv>185.243.131.171:447</psrv>