Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 20:33
Behavioral task
behavioral1
Sample
36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe
Resource
win7-20231129-en
General
-
Target
36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe
-
Size
1.3MB
-
MD5
605e225222c1b58bca2488315a058b0d
-
SHA1
c0fc27a553c1021c8128ec250132e6149a2c42d3
-
SHA256
36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d
-
SHA512
e223eff3973b540fcc67d85bc1e7761dd89a8f0452f5b54730f49c52c20bfd0bee3fd94672b87d30d5ef82b1b6eb1cf8dff0db301677d6c019d1029c6d9482b8
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOrwwyDTWVoWMQvAGeBkgjUiC0Dr:E5aIwC+Agr6StVEnmcKrwwyGwS3u
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4664-17-0x0000000003110000-0x0000000003139000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exepid process 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exedescription pid process Token: SeTcbPrivilege 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe Token: SeTcbPrivilege 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exepid process 4664 36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exedescription pid process target process PID 4664 wrote to memory of 4192 4664 36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe PID 4664 wrote to memory of 4192 4664 36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe PID 4664 wrote to memory of 4192 4664 36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4192 wrote to memory of 3456 4192 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 2856 wrote to memory of 4944 2856 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe PID 4344 wrote to memory of 3588 4344 37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe"C:\Users\Admin\AppData\Local\Temp\36d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exeC:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:872
-
C:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exeC:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4944
-
C:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exeC:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:3588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\37d09a12a42da86d92f6770f082e19a94e6d660a8defa990e6c9dc0bab46d26d.exe
Filesize1.3MB
MD5605e225222c1b58bca2488315a058b0d
SHA1c0fc27a553c1021c8128ec250132e6149a2c42d3
SHA25636d09a12a42da75d82f5660f072e18a94e5d550a7defa990e5c9dc0bab45d25d
SHA512e223eff3973b540fcc67d85bc1e7761dd89a8f0452f5b54730f49c52c20bfd0bee3fd94672b87d30d5ef82b1b6eb1cf8dff0db301677d6c019d1029c6d9482b8
-
Filesize
53KB
MD587cf79a264a8a17e7b1d83a9c56cc215
SHA1796f0f1b54aabaeaa929d134f06f025a544770fd
SHA2567178c6853569a89e2dfad26bc091d931563fd0e2eee6e15396d5b8a4ecd2222c
SHA512c6e3261b0ee93c08701532c68c0b2033a0ca82e4f2e8f223fa25459997a382a30f915b76e3c9e91510e56927fbff83b9da1092f6eb5d92097b1152e4e5df0d92