Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 22:01
Behavioral task
behavioral1
Sample
641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe
Resource
win7-20240220-en
General
-
Target
641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe
-
Size
1.1MB
-
MD5
d25d65dc1a4c5a7c094bc7582bad7cd2
-
SHA1
9b9a0abc353c506ce7d5f31852b841e9ade26e07
-
SHA256
641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915
-
SHA512
0feeb360963ae5098e4569db529164a17dce0ed9af99e6b148a54533af0756e6f30169489c32d2be872b585524f18fba069aa497f3149bff925e1edf7371ae6b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf69As8:E5aIwC+Agr6S/FEAGsji6t
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4644-15-0x00000000029B0000-0x00000000029D9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exepid process 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exedescription pid process Token: SeTcbPrivilege 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe Token: SeTcbPrivilege 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exepid process 4644 641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exedescription pid process target process PID 4644 wrote to memory of 1364 4644 641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe PID 4644 wrote to memory of 1364 4644 641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe PID 4644 wrote to memory of 1364 4644 641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 1364 wrote to memory of 2980 1364 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3284 wrote to memory of 1384 3284 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe PID 3164 wrote to memory of 4356 3164 741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe"C:\Users\Admin\AppData\Local\Temp\641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exeC:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2980
-
C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exeC:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:1384
-
C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exeC:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\741e2eff943b7e109baadccf063149bf989de922e44140f8dbf9f898390d4916.exe
Filesize1.1MB
MD5d25d65dc1a4c5a7c094bc7582bad7cd2
SHA19b9a0abc353c506ce7d5f31852b841e9ade26e07
SHA256641e2eff943b6e108baadccf053148bf878de822e44140f7dbf8f797380d4915
SHA5120feeb360963ae5098e4569db529164a17dce0ed9af99e6b148a54533af0756e6f30169489c32d2be872b585524f18fba069aa497f3149bff925e1edf7371ae6b
-
Filesize
58KB
MD539bf19410d342ad23fa7efd918309f9a
SHA19f5b6afe23cd923f73abd7978e161a448d40bfad
SHA256ca62f546a4bd8ff943e78fd827d1fec1625812a1be48a3f528ffe16f1e1546bf
SHA5126dd4f4c11c1575cfc5ee9810285891bfbbe55b07360a1d912698ca3e5aff77d96e692faa27a69abff2dca11a80cda6234adf55b58fe9b56c960b12581cfc1787