Analysis

  • max time kernel
    135s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-07-2024 21:12

General

  • Target

    06ee138cfcf8035211cb84efb02b1180.exe

  • Size

    1.3MB

  • MD5

    06ee138cfcf8035211cb84efb02b1180

  • SHA1

    83ce60be0a40260cd3d126ee1dd562212f5d7d22

  • SHA256

    112f312ccdda9fd638d1b2806626154eaf7952ebaf3ea5f7df7b3de67e37a6e8

  • SHA512

    fb7ce320dd196ea208b7fd0ac213f52adee85fa18b9966fc0b41a5c641604a676d41e151cb1138e492173bcdad9a3de406dd85d3ecf75d34a1bd9c55b1ed9a13

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQtjmssdqex1hl+dZQZQL:E5aIwC+Agr6StYCr

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\06ee138cfcf8035211cb84efb02b1180.exe
    "C:\Users\Admin\AppData\Local\Temp\06ee138cfcf8035211cb84efb02b1180.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Roaming\WinSocket\07ee139cfcf9036211cb94efb02b1190.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\07ee139cfcf9036211cb94efb02b1190.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:4404
    • C:\Users\Admin\AppData\Roaming\WinSocket\07ee139cfcf9036211cb94efb02b1190.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\07ee139cfcf9036211cb94efb02b1190.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:4228
      • C:\Users\Admin\AppData\Roaming\WinSocket\07ee139cfcf9036211cb94efb02b1190.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\07ee139cfcf9036211cb94efb02b1190.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:1440

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\07ee139cfcf9036211cb94efb02b1190.exe

          Filesize

          1.3MB

          MD5

          06ee138cfcf8035211cb84efb02b1180

          SHA1

          83ce60be0a40260cd3d126ee1dd562212f5d7d22

          SHA256

          112f312ccdda9fd638d1b2806626154eaf7952ebaf3ea5f7df7b3de67e37a6e8

          SHA512

          fb7ce320dd196ea208b7fd0ac213f52adee85fa18b9966fc0b41a5c641604a676d41e151cb1138e492173bcdad9a3de406dd85d3ecf75d34a1bd9c55b1ed9a13

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          52KB

          MD5

          afd31aac429061b84e91f19dd23d2f95

          SHA1

          223635a2c7afb13e58b3f7da57fa1accf469f1bf

          SHA256

          873aeff83a09caea8be1e94eac19d7c738f8491422d17c3b29505bcbf5cf849b

          SHA512

          a78034a907f1ab77329d8e432f75edff47e588bf532da1ae91af149f77e5c50542f87b14e09339597d951fff9f3c12c518e2bb5597450ca8b93758f619b83c95

        • memory/548-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/548-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/548-58-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-59-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-60-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-61-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-62-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-63-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-64-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-65-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-66-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-67-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-68-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/548-69-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/1904-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/1904-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/1904-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-15-0x00000000029D0000-0x00000000029F9000-memory.dmp

          Filesize

          164KB

        • memory/1904-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-14-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-11-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-12-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-9-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-8-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-6-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1904-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4404-46-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/4404-51-0x000001F29B6A0000-0x000001F29B6A1000-memory.dmp

          Filesize

          4KB

        • memory/4404-47-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/4744-29-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4744-52-0x00000000030E0000-0x000000000319E000-memory.dmp

          Filesize

          760KB

        • memory/4744-42-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/4744-27-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-28-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-33-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-53-0x00000000031A0000-0x0000000003469000-memory.dmp

          Filesize

          2.8MB

        • memory/4744-35-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-34-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-36-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-37-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-26-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4744-32-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB