trickbot | 59e1711d6e4323da2dc22cdee30ba8876def991f6e476f29a0d3f983368ab461

Resubmissions

10-10-2021 19:42

211010-yenkgagae6 10

05-01-2021 23:56

210105-gds654e4ba 10

Analysis

max time kernel
26s
max time network
26s
platform
windows10_x64
resource
win10v20201028
submitted
05-01-2021 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mingup.png.exe
Size

424KB
MD5

c851268dcaafc321400f565979a4df2b
SHA1

59040824a53fd84a3023a49776b6fd6f7c0eff75
SHA256

59e1711d6e4323da2dc22cdee30ba8876def991f6e476f29a0d3f983368ab461
SHA512

c218c1beb3792de2845186e56ab10e66df584d937f5cc4337d63ccf288e7d34ee894d499b1a1f14695ff023e53497261f1c1cbdeff21a447b583b2ea083cb06f

Score

10^/10

trickbot lib5 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Executes dropped EXE 1 IoCs

Processes:

mingup.exe

pid process

808 mingup.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wermgr.exe

description pid process

Token: SeDebugPrivilege 3340 wermgr.exe

pid	process
808	mingup.exe

description	pid	process
Token: SeDebugPrivilege	3340	wermgr.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

mingup.png.exemingup.exe

description	pid	process	target process
PID 4644 wrote to memory of 808	4644	mingup.png.exe	mingup.exe
PID 4644 wrote to memory of 808	4644	mingup.png.exe	mingup.exe
PID 4644 wrote to memory of 808	4644	mingup.png.exe	mingup.exe
PID 808 wrote to memory of 3340	808	mingup.exe	wermgr.exe
PID 808 wrote to memory of 3340	808	mingup.exe	wermgr.exe
PID 808 wrote to memory of 3340	808	mingup.exe	wermgr.exe
PID 808 wrote to memory of 3340	808	mingup.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\mingup.png.exe
"C:\Users\Admin\AppData\Local\Temp\mingup.png.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Users\Admin\AppData\Roaming\DesktopColor\mingup.exe
C:\Users\Admin\AppData\Roaming\DesktopColor\mingup.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DesktopColor\mingup.exe
MD5
c851268dcaafc321400f565979a4df2b

SHA1
59040824a53fd84a3023a49776b6fd6f7c0eff75

SHA256
59e1711d6e4323da2dc22cdee30ba8876def991f6e476f29a0d3f983368ab461

SHA512
c218c1beb3792de2845186e56ab10e66df584d937f5cc4337d63ccf288e7d34ee894d499b1a1f14695ff023e53497261f1c1cbdeff21a447b583b2ea083cb06f

Download Submit
C:\Users\Admin\AppData\Roaming\DesktopColor\mingup.exe
MD5
c851268dcaafc321400f565979a4df2b

SHA1
59040824a53fd84a3023a49776b6fd6f7c0eff75

SHA256
59e1711d6e4323da2dc22cdee30ba8876def991f6e476f29a0d3f983368ab461

SHA512
c218c1beb3792de2845186e56ab10e66df584d937f5cc4337d63ccf288e7d34ee894d499b1a1f14695ff023e53497261f1c1cbdeff21a447b583b2ea083cb06f

Download Submit
memory/808-2-0x0000000000000000-mapping.dmp

Download
memory/3340-5-0x0000000000000000-mapping.dmp

Download