Analysis
-
max time kernel
70s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 04:23
Behavioral task
behavioral1
Sample
7ead9199016a67eba03b30203abcd400N.exe
Resource
win7-20240708-en
General
-
Target
7ead9199016a67eba03b30203abcd400N.exe
-
Size
1.3MB
-
MD5
7ead9199016a67eba03b30203abcd400
-
SHA1
c7c74dd876dfd85a3eeccb6ff5da31edf0ee65a8
-
SHA256
ca5bbbce065a38aa9b226a5fffadb4b628ddefd190835a850f0213dbedf65674
-
SHA512
caa2b5ef78b9519687d9efdca316b8e8fcd8c8c1ae90be0c30a442201ff2ba348ae7aa45bc29cfb35ad462c19c09c7744b7be2ab9d832392e73fee0d15a601f6
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOVMId03vDM5CZe0PZWVWz:E5aIwC+Agr6StVEnmcK9dFCfR
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\8ead9199017a78eba03b30203abcd400N.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2252-15-0x00000000002B0000-0x00000000002D9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
8ead9199017a78eba03b30203abcd400N.exe8ead9199017a78eba03b30203abcd400N.exepid process 2572 8ead9199017a78eba03b30203abcd400N.exe 1348 8ead9199017a78eba03b30203abcd400N.exe -
Loads dropped DLL 2 IoCs
Processes:
7ead9199016a67eba03b30203abcd400N.exepid process 2252 7ead9199016a67eba03b30203abcd400N.exe 2252 7ead9199016a67eba03b30203abcd400N.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2320 sc.exe 2680 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
7ead9199016a67eba03b30203abcd400N.exepowershell.exepid process 2252 7ead9199016a67eba03b30203abcd400N.exe 2252 7ead9199016a67eba03b30203abcd400N.exe 2252 7ead9199016a67eba03b30203abcd400N.exe 2600 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe8ead9199017a78eba03b30203abcd400N.exedescription pid process Token: SeDebugPrivilege 2600 powershell.exe Token: SeTcbPrivilege 1348 8ead9199017a78eba03b30203abcd400N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
7ead9199016a67eba03b30203abcd400N.exe8ead9199017a78eba03b30203abcd400N.exe8ead9199017a78eba03b30203abcd400N.exepid process 2252 7ead9199016a67eba03b30203abcd400N.exe 2572 8ead9199017a78eba03b30203abcd400N.exe 1348 8ead9199017a78eba03b30203abcd400N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7ead9199016a67eba03b30203abcd400N.execmd.execmd.execmd.exe8ead9199017a78eba03b30203abcd400N.exetaskeng.exe8ead9199017a78eba03b30203abcd400N.exedescription pid process target process PID 2252 wrote to memory of 2716 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2716 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2716 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2716 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2684 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2684 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2684 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2684 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2148 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2148 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2148 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2148 2252 7ead9199016a67eba03b30203abcd400N.exe cmd.exe PID 2252 wrote to memory of 2572 2252 7ead9199016a67eba03b30203abcd400N.exe 8ead9199017a78eba03b30203abcd400N.exe PID 2252 wrote to memory of 2572 2252 7ead9199016a67eba03b30203abcd400N.exe 8ead9199017a78eba03b30203abcd400N.exe PID 2252 wrote to memory of 2572 2252 7ead9199016a67eba03b30203abcd400N.exe 8ead9199017a78eba03b30203abcd400N.exe PID 2252 wrote to memory of 2572 2252 7ead9199016a67eba03b30203abcd400N.exe 8ead9199017a78eba03b30203abcd400N.exe PID 2716 wrote to memory of 2680 2716 cmd.exe sc.exe PID 2716 wrote to memory of 2680 2716 cmd.exe sc.exe PID 2716 wrote to memory of 2680 2716 cmd.exe sc.exe PID 2716 wrote to memory of 2680 2716 cmd.exe sc.exe PID 2684 wrote to memory of 2320 2684 cmd.exe sc.exe PID 2684 wrote to memory of 2320 2684 cmd.exe sc.exe PID 2684 wrote to memory of 2320 2684 cmd.exe sc.exe PID 2684 wrote to memory of 2320 2684 cmd.exe sc.exe PID 2148 wrote to memory of 2600 2148 cmd.exe powershell.exe PID 2148 wrote to memory of 2600 2148 cmd.exe powershell.exe PID 2148 wrote to memory of 2600 2148 cmd.exe powershell.exe PID 2148 wrote to memory of 2600 2148 cmd.exe powershell.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 2572 wrote to memory of 3044 2572 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 1136 wrote to memory of 1348 1136 taskeng.exe 8ead9199017a78eba03b30203abcd400N.exe PID 1136 wrote to memory of 1348 1136 taskeng.exe 8ead9199017a78eba03b30203abcd400N.exe PID 1136 wrote to memory of 1348 1136 taskeng.exe 8ead9199017a78eba03b30203abcd400N.exe PID 1136 wrote to memory of 1348 1136 taskeng.exe 8ead9199017a78eba03b30203abcd400N.exe PID 1348 wrote to memory of 1788 1348 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 1348 wrote to memory of 1788 1348 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 1348 wrote to memory of 1788 1348 8ead9199017a78eba03b30203abcd400N.exe svchost.exe PID 1348 wrote to memory of 1788 1348 8ead9199017a78eba03b30203abcd400N.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ead9199016a67eba03b30203abcd400N.exe"C:\Users\Admin\AppData\Local\Temp\7ead9199016a67eba03b30203abcd400N.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2680 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2320 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Users\Admin\AppData\Roaming\WinSocket\8ead9199017a78eba03b30203abcd400N.exeC:\Users\Admin\AppData\Roaming\WinSocket\8ead9199017a78eba03b30203abcd400N.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3044
-
C:\Windows\system32\taskeng.exetaskeng.exe {648B50B4-21A0-403E-B1F9-F6E71DBF7C99} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Roaming\WinSocket\8ead9199017a78eba03b30203abcd400N.exeC:\Users\Admin\AppData\Roaming\WinSocket\8ead9199017a78eba03b30203abcd400N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57ead9199016a67eba03b30203abcd400
SHA1c7c74dd876dfd85a3eeccb6ff5da31edf0ee65a8
SHA256ca5bbbce065a38aa9b226a5fffadb4b628ddefd190835a850f0213dbedf65674
SHA512caa2b5ef78b9519687d9efdca316b8e8fcd8c8c1ae90be0c30a442201ff2ba348ae7aa45bc29cfb35ad462c19c09c7744b7be2ab9d832392e73fee0d15a601f6