Analysis

  • max time kernel
    136s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 02:03

General

  • Target

    add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe

  • Size

    1.3MB

  • MD5

    7224d6a1950fe337a6a091f6ca8e5385

  • SHA1

    bb7df5ec2a6731b7815bcfe2f5068d4bacf3c2a7

  • SHA256

    add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2

  • SHA512

    310de0545548518ef15822ae6666216b291569c61c4be1d0297b8d293bf0bbdee1be59382e4eae42b2fa5c7ff7f3d725e78c3b4df88ddbb738fa1f9451814b7f

  • SSDEEP

    24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQETfn9:E5aIwC+Agr6twjVD19

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe
    "C:\Users\Admin\AppData\Local\Temp\add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:4936
    • C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
        • Modifies data under HKEY_USERS
        PID:2168
    • C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:3140

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\WinSocket\add18834486cbe3dcc3718a371ee2e6999e3a94237e82f087aa09dbe0aceacb2.exe

        Filesize

        1.3MB

        MD5

        7224d6a1950fe337a6a091f6ca8e5385

        SHA1

        bb7df5ec2a6731b7815bcfe2f5068d4bacf3c2a7

        SHA256

        add17734475cbe3dcc3617a361ee2e5898e3a94236e72f076aa09dbe0aceacb2

        SHA512

        310de0545548518ef15822ae6666216b291569c61c4be1d0297b8d293bf0bbdee1be59382e4eae42b2fa5c7ff7f3d725e78c3b4df88ddbb738fa1f9451814b7f

      • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

        Filesize

        18KB

        MD5

        a2591d0ae0c4422c487410c16ca4c893

        SHA1

        d057cdf1d7a1e7dea04e7ae580d86761b5886101

        SHA256

        7f375582bb88ab8d657454037b7c1ae9da75920915b568a6f124705dd332ce2d

        SHA512

        813aff479362f0767f6cb9a7ea8278241a1ec8c67391605788e852b57fe4ad8328af3952c9cf814a5ff7ca2b00e16ee7f081293352df97d7bfae9283506008bb

      • memory/1840-3-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-2-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-14-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-13-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-4-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-15-0x0000000003110000-0x0000000003139000-memory.dmp

        Filesize

        164KB

      • memory/1840-12-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-11-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-18-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/1840-17-0x0000000000421000-0x0000000000422000-memory.dmp

        Filesize

        4KB

      • memory/1840-10-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-9-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-8-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-7-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-6-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/1840-5-0x00000000030F0000-0x00000000030F1000-memory.dmp

        Filesize

        4KB

      • memory/2180-36-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-42-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2180-40-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2180-41-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2180-27-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-37-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-26-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-35-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-34-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-33-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-32-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-29-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-28-0x00000000021D0000-0x00000000021D1000-memory.dmp

        Filesize

        4KB

      • memory/2180-52-0x00000000030C0000-0x000000000317E000-memory.dmp

        Filesize

        760KB

      • memory/2180-53-0x0000000003180000-0x0000000003449000-memory.dmp

        Filesize

        2.8MB

      • memory/3716-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/3716-72-0x0000000000421000-0x0000000000422000-memory.dmp

        Filesize

        4KB

      • memory/3716-73-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/4936-46-0x0000000010000000-0x000000001001E000-memory.dmp

        Filesize

        120KB

      • memory/4936-51-0x000002493F3F0000-0x000002493F3F1000-memory.dmp

        Filesize

        4KB