Analysis
-
max time kernel
135s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 01:04
Behavioral task
behavioral1
Sample
9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe
Resource
win7-20240221-en
General
-
Target
9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe
-
Size
1.1MB
-
MD5
5db3ab3ad40e5fcfd755fea0a1728d78
-
SHA1
fd9904dceae0eacabcb2a1aae9120d221bfafd84
-
SHA256
9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1
-
SHA512
31a9299e765814775e3f7ba6d0b8cca30b31931594327278af308e77830d91b2ac3f018e97c0e92984d4b05e601412af1faddd5c52b7c0a66e4324a424cf12af
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/ZcnDPsc:E5aIwC+Agr6S/FFC+Lsc
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1924-15-0x00000000002F0000-0x0000000000319000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exepid process 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe 2044 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe 2996 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe -
Loads dropped DLL 2 IoCs
Processes:
9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exepid process 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2548 sc.exe 2704 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exepowershell.exepid process 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 2284 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exedescription pid process Token: SeDebugPrivilege 2284 powershell.exe Token: SeTcbPrivilege 2044 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe Token: SeTcbPrivilege 2996 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exepid process 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe 2044 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe 2996 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.execmd.execmd.execmd.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exetaskeng.exe9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exedescription pid process target process PID 1924 wrote to memory of 1912 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 1912 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 1912 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 1912 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2532 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2532 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2532 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2532 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2596 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2596 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2596 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2596 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe cmd.exe PID 1924 wrote to memory of 2492 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 1924 wrote to memory of 2492 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 1924 wrote to memory of 2492 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 1924 wrote to memory of 2492 1924 9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 1912 wrote to memory of 2704 1912 cmd.exe sc.exe PID 1912 wrote to memory of 2704 1912 cmd.exe sc.exe PID 1912 wrote to memory of 2704 1912 cmd.exe sc.exe PID 1912 wrote to memory of 2704 1912 cmd.exe sc.exe PID 2532 wrote to memory of 2548 2532 cmd.exe sc.exe PID 2532 wrote to memory of 2548 2532 cmd.exe sc.exe PID 2532 wrote to memory of 2548 2532 cmd.exe sc.exe PID 2532 wrote to memory of 2548 2532 cmd.exe sc.exe PID 2596 wrote to memory of 2284 2596 cmd.exe powershell.exe PID 2596 wrote to memory of 2284 2596 cmd.exe powershell.exe PID 2596 wrote to memory of 2284 2596 cmd.exe powershell.exe PID 2596 wrote to memory of 2284 2596 cmd.exe powershell.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2492 wrote to memory of 2412 2492 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2304 wrote to memory of 2044 2304 taskeng.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 2304 wrote to memory of 2044 2304 taskeng.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 2304 wrote to memory of 2044 2304 taskeng.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 2304 wrote to memory of 2044 2304 taskeng.exe 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe PID 2044 wrote to memory of 1996 2044 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2044 wrote to memory of 1996 2044 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2044 wrote to memory of 1996 2044 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe PID 2044 wrote to memory of 1996 2044 9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe"C:\Users\Admin\AppData\Local\Temp\9e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2704 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2548 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exeC:\Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2412
-
C:\Windows\system32\taskeng.exetaskeng.exe {6311C1E0-885A-456F-8B5A-248700B27480} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exeC:\Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1996
-
C:\Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exeC:\Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2996 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\9e4e42cf37a80196dcd6ac7c68dae7979d9ee0717098319791a30cee29f209e1.exe
Filesize1.1MB
MD55db3ab3ad40e5fcfd755fea0a1728d78
SHA1fd9904dceae0eacabcb2a1aae9120d221bfafd84
SHA2569e4e42cf36a70195dcd5ac6c57dae6868d9ee0616097319681a30cee28f208e1
SHA51231a9299e765814775e3f7ba6d0b8cca30b31931594327278af308e77830d91b2ac3f018e97c0e92984d4b05e601412af1faddd5c52b7c0a66e4324a424cf12af