2019-12-28: #TrickBot Loader #Malware -> '1079' Core Bot
Cert: [LIT-DAN UKIS UAB] #Sectigo
Crypter
CryptStringToBinaryA -> malloc -> window (hide)-> memcpy -> resource -> VirtualAllocExNuma -> Crypto Key Decrypt
Same '1079'

https://twitter.com/VK_Intel/status/1204673384539475968 …
h/t @malwrhunterteampic.twitter.com/Ow9ZZIktEr