Trickbot Oct 24

https://www.hybrid-analysis.com/sample/a3bda837a3003b1b43b52ceb693ffec17dbca879aad2399cad836232a218ff60?environmentId=100

dl
http://webshopnumij.nl/lvconfig/surarsors.png
http://swarmgrammars.vonmammen.org/dump/surarsors.png

config:
<mcconf>
   <ver>1000075</ver>
   <gtag>kas56</gtag>
   <servs>
      <srv>176.120.126.21:449</srv>
      <srv>156.17.92.161:449</srv>
      <srv>178.254.183.34:449</srv>
      <srv>178.254.183.13:449</srv>
      <srv>94.251.188.225:449</srv>
      <srv>178.169.129.202:449</srv>
      <srv>188.120.249.181:443</srv>
      <srv>62.109.9.121:443</srv>
      <srv>185.34.52.193:443</srv>
      <srv>62.109.24.224:443</srv>
      <srv>82.146.59.195:443</srv>
      <srv>80.87.198.199:443</srv>
      <srv>62.109.26.77:443</srv>
      <srv>194.87.234.254:443</srv>
      <srv>194.87.236.14:443</srv>
      <srv>188.120.249.77:443</srv>
      <srv>188.120.249.119:443</srv>
      <srv>194.87.238.250:443</srv>
      <srv>195.133.146.221:443</srv>
      <srv>194.87.102.114:443</srv>
      <srv>185.80.128.122:443</srv>
      <srv>188.120.249.190:443</srv>
      <srv>194.87.111.202:443</srv>
      <srv>185.125.46.104:443</srv>
      <srv>194.87.237.249:443</srv>
      <srv>62.109.29.243:443</srv>
      <srv>95.154.199.47:443</srv>
      <srv>62.109.17.145:443</srv>
      <srv>185.158.115.7:443</srv>
   </servs>
   <autorun>
      <module name="systeminfo" ctl="GetSystemInfo" />
      <module name="injectDll" />
   </autorun>
</mcconf>