Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:52
Behavioral task
behavioral1
Sample
976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe
Resource
win7-20240221-en
General
-
Target
976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe
-
Size
1.1MB
-
MD5
7db52a58e3df4e7599b9e1d8611d2ff6
-
SHA1
125de48e32eb939896bb12ae92b68d6b05b34b50
-
SHA256
976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6
-
SHA512
be848e065c54d0edbdada0cf13049e004ba4781d195027383d0e85d2e1fd574a45394b5dce9e1019abddc31c2d17c45a42de44e74b7659ac6074e22f8e846b2e
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/Zc9ggeMj6:E5aIwC+Agr6S/FFC+Zj6
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/1768-15-0x00000000029D0000-0x00000000029F9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exepid process 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exedescription pid process Token: SeTcbPrivilege 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe Token: SeTcbPrivilege 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exepid process 1768 976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exedescription pid process target process PID 1768 wrote to memory of 516 1768 976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe PID 1768 wrote to memory of 516 1768 976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe PID 1768 wrote to memory of 516 1768 976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 516 wrote to memory of 2012 516 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 3744 wrote to memory of 3688 3744 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe PID 4384 wrote to memory of 1004 4384 987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe"C:\Users\Admin\AppData\Local\Temp\976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exeC:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exeC:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exeC:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\987e82a39a96a27f2b1083814c2be017808e008b808324e1996a0a9b028c60f7.exeFilesize
1.1MB
MD57db52a58e3df4e7599b9e1d8611d2ff6
SHA1125de48e32eb939896bb12ae92b68d6b05b34b50
SHA256976e72a39a95a26f2b1073714c2be016707e007b707324e1995a0a8b027c50f6
SHA512be848e065c54d0edbdada0cf13049e004ba4781d195027383d0e85d2e1fd574a45394b5dce9e1019abddc31c2d17c45a42de44e74b7659ac6074e22f8e846b2e
-
C:\Users\Admin\AppData\Roaming\WinSocket\settings.iniFilesize
19KB
MD520f7e4557b8c32ec2beb35b6df0debc4
SHA112ff4728c0419990f22070901ccaa934a30fa3cb
SHA256f8efcc3654f9984faa17f53ef4138282d47cb763b30e340baa26020ac6f3042f
SHA5121f1d5ed21830b70889d68260f3fe8e07cc14183c483a749428e5f74634402a4ac6f323fc128ea9f9907ea4dd9e3abb7ca269cbacf6faf5cb463429d8d400dc88
-
memory/516-26-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-29-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-36-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-41-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/516-40-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/516-42-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/516-34-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-27-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-28-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-52-0x0000000003060000-0x000000000311E000-memory.dmpFilesize
760KB
-
memory/516-30-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-31-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-32-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-33-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-53-0x0000000003160000-0x0000000003429000-memory.dmpFilesize
2.8MB
-
memory/516-37-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/516-35-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/1768-15-0x00000000029D0000-0x00000000029F9000-memory.dmpFilesize
164KB
-
memory/1768-11-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/1768-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1768-14-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-9-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-3-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-4-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-5-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-6-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-7-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-8-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-10-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-13-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-12-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/1768-2-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/2012-46-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2012-51-0x000001C20B040000-0x000001C20B041000-memory.dmpFilesize
4KB
-
memory/3744-71-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/3744-58-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-65-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-67-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-69-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-73-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3744-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-61-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-68-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-66-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-64-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-63-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-62-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3744-59-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB