Analysis
-
max time kernel
135s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 02:05
Behavioral task
behavioral1
Sample
b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe
Resource
win7-20240221-en
General
-
Target
b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe
-
Size
1.1MB
-
MD5
5c4906004e74ec9700226dd3ec8fab6d
-
SHA1
4a6f23f7f2b71f48a2a8ff357005b4030003c3f9
-
SHA256
b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c
-
SHA512
2bf8d979fd75ff12518206a3e988ba926be3a8a17e797ea9972633c1685303f62de65db950e3dd9abd1d492b50749890899066f2d0a16613d747ab2b9eaa233e
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/ZcnDPMD3:E5aIwC+Agr6S/FFC+Lc
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2184-15-0x00000000003C0000-0x00000000003E9000-memory.dmp trickbot_loader32 -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exepid process 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe 2720 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe 3000 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe -
Loads dropped DLL 2 IoCs
Processes:
b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exepid process 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2556 sc.exe 2548 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exepowershell.exepid process 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe 2604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exedescription pid process Token: SeDebugPrivilege 2604 powershell.exe Token: SeTcbPrivilege 2720 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe Token: SeTcbPrivilege 3000 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exepid process 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe 2720 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe 3000 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.execmd.execmd.execmd.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exetaskeng.exeb3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exedescription pid process target process PID 2184 wrote to memory of 2948 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2948 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2948 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2948 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2512 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2512 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2512 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2512 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2584 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2584 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2584 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2584 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe cmd.exe PID 2184 wrote to memory of 2768 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 2184 wrote to memory of 2768 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 2184 wrote to memory of 2768 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 2184 wrote to memory of 2768 2184 b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 2948 wrote to memory of 2548 2948 cmd.exe sc.exe PID 2948 wrote to memory of 2548 2948 cmd.exe sc.exe PID 2948 wrote to memory of 2548 2948 cmd.exe sc.exe PID 2948 wrote to memory of 2548 2948 cmd.exe sc.exe PID 2512 wrote to memory of 2556 2512 cmd.exe sc.exe PID 2512 wrote to memory of 2556 2512 cmd.exe sc.exe PID 2512 wrote to memory of 2556 2512 cmd.exe sc.exe PID 2512 wrote to memory of 2556 2512 cmd.exe sc.exe PID 2584 wrote to memory of 2604 2584 cmd.exe powershell.exe PID 2584 wrote to memory of 2604 2584 cmd.exe powershell.exe PID 2584 wrote to memory of 2604 2584 cmd.exe powershell.exe PID 2584 wrote to memory of 2604 2584 cmd.exe powershell.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2768 wrote to memory of 2416 2768 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 1464 wrote to memory of 2720 1464 taskeng.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 1464 wrote to memory of 2720 1464 taskeng.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 1464 wrote to memory of 2720 1464 taskeng.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 1464 wrote to memory of 2720 1464 taskeng.exe b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe PID 2720 wrote to memory of 1960 2720 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2720 wrote to memory of 1960 2720 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2720 wrote to memory of 1960 2720 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe PID 2720 wrote to memory of 1960 2720 b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe"C:\Users\Admin\AppData\Local\Temp\b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2548 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2556 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeC:\Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2416
-
C:\Windows\system32\taskeng.exetaskeng.exe {D54CAE31-5928-47B7-9016-2AA48E305B37} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeC:\Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1960
-
C:\Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exeC:\Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\b3f11a399dfa71622c1a34822889317eae9c21afcc120a01c920f4f199a6ce7c.exe
Filesize1.1MB
MD55c4906004e74ec9700226dd3ec8fab6d
SHA14a6f23f7f2b71f48a2a8ff357005b4030003c3f9
SHA256b3f11a399dfa61522c1a34722779316eae8c21afcc120a01c820f4f198a5ce6c
SHA5122bf8d979fd75ff12518206a3e988ba926be3a8a17e797ea9972633c1685303f62de65db950e3dd9abd1d492b50749890899066f2d0a16613d747ab2b9eaa233e