Analysis
-
max time kernel
135s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 02:03
Behavioral task
behavioral1
Sample
add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe
Resource
win7-20240220-en
General
-
Target
add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe
-
Size
1.3MB
-
MD5
7224d6a1950fe337a6a091f6ca8e5385
-
SHA1
bb7df5ec2a6731b7815bcfe2f5068d4bacf3c2a7
-
SHA256
add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2
-
SHA512
310de0545548518ef15822ae6666216b291569c61c4be1d0297b8d293bf0bbdee1be59382e4eae42b2fa5c7ff7f3d725e78c3b4df88ddbb738fa1f9451814b7f
-
SSDEEP
24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQETfn9:E5aIwC+Agr6twjVD19
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2040-15-0x00000000003D0000-0x00000000003F9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exepid process 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe 2784 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe 2308 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe -
Loads dropped DLL 2 IoCs
Processes:
add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exepid process 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2488 sc.exe 2808 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exepowershell.exepid process 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe 2368 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exedescription pid process Token: SeDebugPrivilege 2368 powershell.exe Token: SeTcbPrivilege 2784 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe Token: SeTcbPrivilege 2308 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exepid process 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe 2784 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe 2308 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.execmd.execmd.execmd.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exetaskeng.exeadd18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exedescription pid process target process PID 2040 wrote to memory of 2572 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2572 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2572 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2572 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2644 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2644 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2644 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2644 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2564 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2564 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2564 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2564 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe cmd.exe PID 2040 wrote to memory of 2380 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2040 wrote to memory of 2380 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2040 wrote to memory of 2380 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2040 wrote to memory of 2380 2040 add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2572 wrote to memory of 2808 2572 cmd.exe sc.exe PID 2572 wrote to memory of 2808 2572 cmd.exe sc.exe PID 2572 wrote to memory of 2808 2572 cmd.exe sc.exe PID 2572 wrote to memory of 2808 2572 cmd.exe sc.exe PID 2644 wrote to memory of 2488 2644 cmd.exe sc.exe PID 2644 wrote to memory of 2488 2644 cmd.exe sc.exe PID 2644 wrote to memory of 2488 2644 cmd.exe sc.exe PID 2644 wrote to memory of 2488 2644 cmd.exe sc.exe PID 2564 wrote to memory of 2368 2564 cmd.exe powershell.exe PID 2564 wrote to memory of 2368 2564 cmd.exe powershell.exe PID 2564 wrote to memory of 2368 2564 cmd.exe powershell.exe PID 2564 wrote to memory of 2368 2564 cmd.exe powershell.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2380 wrote to memory of 2448 2380 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2460 wrote to memory of 2784 2460 taskeng.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2460 wrote to memory of 2784 2460 taskeng.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2460 wrote to memory of 2784 2460 taskeng.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2460 wrote to memory of 2784 2460 taskeng.exe add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe PID 2784 wrote to memory of 2468 2784 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2784 wrote to memory of 2468 2784 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2784 wrote to memory of 2468 2784 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe PID 2784 wrote to memory of 2468 2784 add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe"C:\Users\Admin\AppData\Local\Temp\add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2808 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2488 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368 -
C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeC:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2448
-
C:\Windows\system32\taskeng.exetaskeng.exe {B6E13A70-0ED6-4220-860A-BA636B480EFC} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeC:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2468
-
C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exeC:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2308 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe
Filesize1.3MB
MD57224d6a1950fe337a6a091f6ca8e5385
SHA1bb7df5ec2a6731b7815bcfe2f5068d4bacf3c2a7
SHA256add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2
SHA512310de0545548518ef15822ae6666216b291569c61c4be1d0297b8d293bf0bbdee1be59382e4eae42b2fa5c7ff7f3d725e78c3b4df88ddbb738fa1f9451814b7f