TrendLabs: Trickbot Shows Off New Trick: Password Grabber Module

Figure 6. Trickbot’s shareDll32 module allows it to connect to a C&C server to download a copy of itself

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module/