Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 22:01

General

  • Target

    641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe

  • Size

    1.1MB

  • MD5

    d25d65dc1a4c5a7c094bc7582bad7cd2

  • SHA1

    9b9a0abc353c506ce7d5f31852b841e9ade26e07

  • SHA256

    641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915

  • SHA512

    0feeb360963ae5098e4569db529164a17dce0ed9af99e6b148a54533af0756e6f30169489c32d2be872b585524f18fba069aa497f3149bff925e1edf7371ae6b

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf69As8:E5aIwC+Agr6S/FEAGsji6t

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe
    "C:\Users\Admin\AppData\Local\Temp\641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2980
    • C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:1384
      • C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3164
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:4356

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe

          Filesize

          1.1MB

          MD5

          d25d65dc1a4c5a7c094bc7582bad7cd2

          SHA1

          9b9a0abc353c506ce7d5f31852b841e9ade26e07

          SHA256

          641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915

          SHA512

          0feeb360963ae5098e4569db529164a17dce0ed9af99e6b148a54533af0756e6f30169489c32d2be872b585524f18fba069aa497f3149bff925e1edf7371ae6b

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          58KB

          MD5

          39bf19410d342ad23fa7efd918309f9a

          SHA1

          9f5b6afe23cd923f73abd7978e161a448d40bfad

          SHA256

          ca62f546a4bd8ff943e78fd827d1fec1625812a1be48a3f528ffe16f1e1546bf

          SHA512

          6dd4f4c11c1575cfc5ee9810285891bfbbe55b07360a1d912698ca3e5aff77d96e692faa27a69abff2dca11a80cda6234adf55b58fe9b56c960b12581cfc1787

        • memory/1364-34-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-30-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-36-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/1364-42-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/1364-26-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-27-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-28-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-29-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-52-0x0000000003060000-0x000000000311E000-memory.dmp

          Filesize

          760KB

        • memory/1364-31-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-32-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-33-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-35-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/1364-53-0x0000000003160000-0x0000000003429000-memory.dmp

          Filesize

          2.8MB

        • memory/1364-37-0x00000000022E0000-0x00000000022E1000-memory.dmp

          Filesize

          4KB

        • memory/2980-46-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/2980-51-0x0000014E5CA00000-0x0000014E5CA01000-memory.dmp

          Filesize

          4KB

        • memory/3284-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/3284-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/3284-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/3284-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/4644-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/4644-7-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-14-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-10-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-12-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-8-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-11-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-6-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-9-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-5-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-4-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-3-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-2-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/4644-15-0x00000000029B0000-0x00000000029D9000-memory.dmp

          Filesize

          164KB

        • memory/4644-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4644-13-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB