Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 10:36
Behavioral task
behavioral1
Sample
0a7b8509692f0f9b871c7c25df7236f0.exe
Resource
win7-20240221-en
General
-
Target
0a7b8509692f0f9b871c7c25df7236f0.exe
-
Size
1.0MB
-
MD5
0a7b8509692f0f9b871c7c25df7236f0
-
SHA1
212db72c960e36d46467302cb79870fd44371178
-
SHA256
7c41ee75e37ecc7fbd9de1c9f58fda942e6c0962d00dc1b77e32b3f65a3741c8
-
SHA512
7b77fb482bb568526dc01275093da29a7b4260fd8f4a8cbe98f6024ea511b1d97a1f08dbe16f3d0daadcd68a859fcae5a2b5d8ba95bb9971b96761e34825c62b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUkhmZ9skw:E5aIwC+Agr6SNbG
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4840-17-0x0000000002B80000-0x0000000002BA9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
0a8b9609792f0f9b981c8c26df8237f0.exe0a8b9609792f0f9b981c8c26df8237f0.exe0a8b9609792f0f9b981c8c26df8237f0.exepid process 1212 0a8b9609792f0f9b981c8c26df8237f0.exe 1652 0a8b9609792f0f9b981c8c26df8237f0.exe 3340 0a8b9609792f0f9b981c8c26df8237f0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0a8b9609792f0f9b981c8c26df8237f0.exe0a8b9609792f0f9b981c8c26df8237f0.exedescription pid process Token: SeTcbPrivilege 1652 0a8b9609792f0f9b981c8c26df8237f0.exe Token: SeTcbPrivilege 3340 0a8b9609792f0f9b981c8c26df8237f0.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
0a7b8509692f0f9b871c7c25df7236f0.exe0a8b9609792f0f9b981c8c26df8237f0.exe0a8b9609792f0f9b981c8c26df8237f0.exe0a8b9609792f0f9b981c8c26df8237f0.exepid process 4840 0a7b8509692f0f9b871c7c25df7236f0.exe 1212 0a8b9609792f0f9b981c8c26df8237f0.exe 1652 0a8b9609792f0f9b981c8c26df8237f0.exe 3340 0a8b9609792f0f9b981c8c26df8237f0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a7b8509692f0f9b871c7c25df7236f0.exe0a8b9609792f0f9b981c8c26df8237f0.exe0a8b9609792f0f9b981c8c26df8237f0.exe0a8b9609792f0f9b981c8c26df8237f0.exedescription pid process target process PID 4840 wrote to memory of 1212 4840 0a7b8509692f0f9b871c7c25df7236f0.exe 0a8b9609792f0f9b981c8c26df8237f0.exe PID 4840 wrote to memory of 1212 4840 0a7b8509692f0f9b871c7c25df7236f0.exe 0a8b9609792f0f9b981c8c26df8237f0.exe PID 4840 wrote to memory of 1212 4840 0a7b8509692f0f9b871c7c25df7236f0.exe 0a8b9609792f0f9b981c8c26df8237f0.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1212 wrote to memory of 1124 1212 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 1652 wrote to memory of 1844 1652 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe PID 3340 wrote to memory of 1696 3340 0a8b9609792f0f9b981c8c26df8237f0.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a7b8509692f0f9b871c7c25df7236f0.exe"C:\Users\Admin\AppData\Local\Temp\0a7b8509692f0f9b871c7c25df7236f0.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exeC:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exeC:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exeC:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\0a8b9609792f0f9b981c8c26df8237f0.exeFilesize
1.0MB
MD50a7b8509692f0f9b871c7c25df7236f0
SHA1212db72c960e36d46467302cb79870fd44371178
SHA2567c41ee75e37ecc7fbd9de1c9f58fda942e6c0962d00dc1b77e32b3f65a3741c8
SHA5127b77fb482bb568526dc01275093da29a7b4260fd8f4a8cbe98f6024ea511b1d97a1f08dbe16f3d0daadcd68a859fcae5a2b5d8ba95bb9971b96761e34825c62b
-
C:\Users\Admin\AppData\Roaming\WinSocket\settings.iniFilesize
40KB
MD58ad5f0d59d7aa2bb3a5b596b45036336
SHA1aa20c8a825c9b0f9b248cada13483ac94437ee54
SHA25634c609a04a9d3c2a4f18d20c4f6d735307b54298d12dc9ac7fdc9240c4916c3e
SHA512a6e7cc0864d2097ef56c5f775f4eb90d3bec646149687cd74175929536b93de7d5fc1d39492abed1fc9b259863945e91de2658a01368c167a673b71ce629a521
-
memory/1124-53-0x000002351DD70000-0x000002351DD71000-memory.dmpFilesize
4KB
-
memory/1124-47-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/1212-29-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-30-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-41-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/1212-40-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1212-27-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-28-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-35-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-51-0x00000000030A0000-0x000000000315E000-memory.dmpFilesize
760KB
-
memory/1212-31-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-32-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-33-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-34-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-52-0x0000000003160000-0x0000000003429000-memory.dmpFilesize
2.8MB
-
memory/1212-26-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-37-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1212-36-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1652-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-73-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1652-72-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/1652-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1652-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/4840-17-0x0000000002B80000-0x0000000002BA9000-memory.dmpFilesize
164KB
-
memory/4840-10-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-3-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-13-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-5-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-11-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-14-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-9-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-12-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-15-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/4840-8-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-7-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-6-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-4-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4840-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4840-2-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB