drokbk | 64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
Size

313KB
MD5

e26a66bfe0da89405e25a66baad95b05
SHA1

4eb5c832ce940739d6c0eb1b4fc7a78def1dd15e
SHA256

64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b
SHA512

2b24ae439a012e0dd8c0cf2669909d9e4b3ffa937dd856dd149db72ca231d749d63e7e960d41e57649b72b17f35f8b030d34f12e33aef6d4451e000ea4a2eb78
SSDEEP

6144:DDKW1Lgbdl0TBBvjc/h6iNYKfER27VcHmb7epjV5khYVyewqF:Xh1Lk70Tnvjc5zfEcapjVBNF

Score

10^/10

drokbk backdoor dropper persistence

Malware Config

Signatures

Drokbk
Drokbk is a custom .NET dropper and backdoor.
dropper backdoor drokbk

Drokbk payload 3 IoCs

resource	yara_rule
behavioral2/memory/4212-1957-0x0000000005330000-0x000000000533A000-memory.dmp	family_drokbk
behavioral2/files/0x0003000000022d25-1966.dat	family_drokbk
behavioral2/memory/3968-1972-0x0000000000B00000-0x0000000000B0A000-memory.dmp	family_drokbk

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe

Executes dropped EXE 1 IoCs

pid	Process
3968	SessionService.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4700	sc.exe
1880	sc.exe
444	sc.exe
4764	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SessionService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
Token: SeDebugPrivilege	3968	SessionService.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4764	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	109
PID 4212 wrote to memory of 4764	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	109
PID 4212 wrote to memory of 4764	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	109
PID 4212 wrote to memory of 4700	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	111
PID 4212 wrote to memory of 4700	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	111
PID 4212 wrote to memory of 4700	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	111
PID 4212 wrote to memory of 1880	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	113
PID 4212 wrote to memory of 1880	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	113
PID 4212 wrote to memory of 1880	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	113
PID 4212 wrote to memory of 444	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	115
PID 4212 wrote to memory of 444	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	115
PID 4212 wrote to memory of 444	4212	64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe	115

C:\Users\Admin\AppData\Local\Temp\64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
"C:\Users\Admin\AppData\Local\Temp\64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create "SessionManagerService" binpath= "c:\programdata\SoftwareDistribution\SessionService.exe" start= delayed-auto
  2⤵
  - Launches sc.exe
  PID:4764
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" config "SessionManagerService" DisplayName= "Session Manager Service"
  2⤵
  - Launches sc.exe
  PID:4700
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description "SessionManagerService" "Provides Kernel Compatibility With User Session-Management Service."
  2⤵
  - Launches sc.exe
  PID:1880
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start "SessionManagerService"
  2⤵
  - Launches sc.exe
  PID:444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:412

\??\c:\programdata\SoftwareDistribution\SessionService.exe
c:\programdata\SoftwareDistribution\SessionService.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\pla

Filesize
11KB

MD5
14a0e5665a95714ff4951bd35eb73606

SHA1
0426f65ea5bcff9e0dc48e236bbec293380ccc43

SHA256
a8e18a84898f46cd88813838f5e69f05240c4853af2aee5917dcee3a3e2a5d5a

SHA512
fe44d9ae670eac4a39567c4ae8deee6f4205d4908c4f78d822e3bb586c0183de7d6efe4b45f14b92da77fc6c24f426a6af14a3280fd5d4a7faa34123e59a4720

Download Submit
memory/3968-1973-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/3968-1972-0x0000000000B00000-0x0000000000B0A000-memory.dmp

Filesize
40KB

Download
memory/3968-1975-0x0000000003FB0000-0x0000000003FD2000-memory.dmp

Filesize
136KB

Download
memory/3968-1976-0x0000000001A80000-0x0000000001A90000-memory.dmp

Filesize
64KB

Download
memory/3968-1978-0x0000000001A80000-0x0000000001A90000-memory.dmp

Filesize
64KB

Download
memory/3968-1977-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/4212-35-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-39-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-4-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download
memory/4212-5-0x0000000004B30000-0x0000000004B8E000-memory.dmp

Filesize
376KB

Download
memory/4212-6-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-7-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-9-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-11-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-13-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-15-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-17-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-19-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-23-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-21-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-25-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-29-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-31-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-27-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-33-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-2-0x0000000004A40000-0x0000000004AA0000-memory.dmp

Filesize
384KB

Download
memory/4212-37-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-43-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-41-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-3-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4212-45-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-49-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-51-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-47-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-53-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-55-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-57-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-59-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-61-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-67-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-69-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-65-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-63-0x0000000004B30000-0x0000000004B88000-memory.dmp

Filesize
352KB

Download
memory/4212-1956-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4212-1957-0x0000000005330000-0x000000000533A000-memory.dmp

Filesize
40KB

Download
memory/4212-1959-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/4212-1960-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4212-1961-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4212-1962-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4212-1-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4212-0-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/4212-1968-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4212-1974-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download