Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 22:51
Behavioral task
behavioral1
Sample
6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe
Resource
win7-20240215-en
General
-
Target
6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe
-
Size
1.2MB
-
MD5
0734dbb826e9c3a2b1fb88758b6a508f
-
SHA1
f2d04219251f72e60136058092d81c83165b3ec8
-
SHA256
6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a
-
SHA512
7722f1cc339dfda71f7310dc37c85571e58fbd352d42a03f9d2df278025fd799f232a3bbcfca8d5efbae5cec86e91b1c4eb4a5531555ca6047703c840c726fc8
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51WnR5:E5aIwC+Agr6StVEnmcKxY/O1e
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/3372-17-0x0000000002AF0000-0x0000000002B19000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exepid process 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exedescription pid process Token: SeTcbPrivilege 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe Token: SeTcbPrivilege 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exepid process 3372 6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exedescription pid process target process PID 3372 wrote to memory of 4556 3372 6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe PID 3372 wrote to memory of 4556 3372 6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe PID 3372 wrote to memory of 4556 3372 6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4556 wrote to memory of 4292 4556 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 4796 wrote to memory of 3196 4796 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe PID 2092 wrote to memory of 3248 2092 7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe"C:\Users\Admin\AppData\Local\Temp\6862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exeC:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:4016
-
C:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exeC:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:3196
-
C:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exeC:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:3248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\7972e318e1b4abc0aeedf2914e782032a39370bb920b92df0c40e69f192b1c0a.exe
Filesize1.2MB
MD50734dbb826e9c3a2b1fb88758b6a508f
SHA1f2d04219251f72e60136058092d81c83165b3ec8
SHA2566862e317e1b4abc0aeedf2914e672032a38360bb820b82df0c40e59f182b1c0a
SHA5127722f1cc339dfda71f7310dc37c85571e58fbd352d42a03f9d2df278025fd799f232a3bbcfca8d5efbae5cec86e91b1c4eb4a5531555ca6047703c840c726fc8
-
Filesize
19KB
MD52811d6bb5cc663f8f8c47eaca38bf970
SHA135512bea8b7a43aef07dab9cbc102f11e4dfaa71
SHA2566f9e3054330983d0ee676eb696443ec5d429182def059f504c81abdbf034b11b
SHA512e2ff42e5ebc8ab090af2096cbdd99edb3363de72b84dcb0d3ee3fe54606bf8a4abc969bda19b341fe37e0ed4a5be0a93099dd9277720115f6d31645085267cac