Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 11:24
Behavioral task
behavioral1
Sample
ade245651893caf20eef1a329e971320N.exe
Resource
win7-20240705-en
General
-
Target
ade245651893caf20eef1a329e971320N.exe
-
Size
1.2MB
-
MD5
ade245651893caf20eef1a329e971320
-
SHA1
2ea7929a8e1c498c9d2dcb5b283507f50dd1c26f
-
SHA256
9349eeab73ffe8ecb2a6cfd10d61c32bc122afbe867ac20d169016f97ffb7412
-
SHA512
98fdac86f7b28a29668490569adce643ddf2288cb051696d8f99f3b8a4bd71e837552dfb8523d45f618824a559626c5fd7575eef03f737d58635320dbd8b94e6
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9+s8juCCK4oV:E5aIwC+Agr6SNasrsFCmu
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016c7d-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2084-15-0x0000000000310000-0x0000000000339000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2180 ade246761993caf20eef1a329e981320N.exe 2052 ade246761993caf20eef1a329e981320N.exe -
Loads dropped DLL 2 IoCs
pid Process 2084 ade245651893caf20eef1a329e971320N.exe 2084 ade245651893caf20eef1a329e971320N.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2756 sc.exe 1756 sc.exe 2604 sc.exe 2712 sc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2084 ade245651893caf20eef1a329e971320N.exe 2084 ade245651893caf20eef1a329e971320N.exe 2084 ade245651893caf20eef1a329e971320N.exe 2180 ade246761993caf20eef1a329e981320N.exe 2180 ade246761993caf20eef1a329e981320N.exe 2180 ade246761993caf20eef1a329e981320N.exe 2636 powershell.exe 2656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2636 powershell.exe Token: SeDebugPrivilege 2656 powershell.exe Token: SeTcbPrivilege 2052 ade246761993caf20eef1a329e981320N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2084 ade245651893caf20eef1a329e971320N.exe 2180 ade246761993caf20eef1a329e981320N.exe 2052 ade246761993caf20eef1a329e981320N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2500 2084 ade245651893caf20eef1a329e971320N.exe 30 PID 2084 wrote to memory of 2500 2084 ade245651893caf20eef1a329e971320N.exe 30 PID 2084 wrote to memory of 2500 2084 ade245651893caf20eef1a329e971320N.exe 30 PID 2084 wrote to memory of 2500 2084 ade245651893caf20eef1a329e971320N.exe 30 PID 2084 wrote to memory of 1344 2084 ade245651893caf20eef1a329e971320N.exe 31 PID 2084 wrote to memory of 1344 2084 ade245651893caf20eef1a329e971320N.exe 31 PID 2084 wrote to memory of 1344 2084 ade245651893caf20eef1a329e971320N.exe 31 PID 2084 wrote to memory of 1344 2084 ade245651893caf20eef1a329e971320N.exe 31 PID 2084 wrote to memory of 1168 2084 ade245651893caf20eef1a329e971320N.exe 33 PID 2084 wrote to memory of 1168 2084 ade245651893caf20eef1a329e971320N.exe 33 PID 2084 wrote to memory of 1168 2084 ade245651893caf20eef1a329e971320N.exe 33 PID 2084 wrote to memory of 1168 2084 ade245651893caf20eef1a329e971320N.exe 33 PID 2084 wrote to memory of 2180 2084 ade245651893caf20eef1a329e971320N.exe 36 PID 2084 wrote to memory of 2180 2084 ade245651893caf20eef1a329e971320N.exe 36 PID 2084 wrote to memory of 2180 2084 ade245651893caf20eef1a329e971320N.exe 36 PID 2084 wrote to memory of 2180 2084 ade245651893caf20eef1a329e971320N.exe 36 PID 2180 wrote to memory of 2724 2180 ade246761993caf20eef1a329e981320N.exe 37 PID 2180 wrote to memory of 2724 2180 ade246761993caf20eef1a329e981320N.exe 37 PID 2180 wrote to memory of 2724 2180 ade246761993caf20eef1a329e981320N.exe 37 PID 2180 wrote to memory of 2724 2180 ade246761993caf20eef1a329e981320N.exe 37 PID 2180 wrote to memory of 1944 2180 ade246761993caf20eef1a329e981320N.exe 38 PID 2180 wrote to memory of 1944 2180 ade246761993caf20eef1a329e981320N.exe 38 PID 2180 wrote to memory of 1944 2180 ade246761993caf20eef1a329e981320N.exe 38 PID 2180 wrote to memory of 1944 2180 ade246761993caf20eef1a329e981320N.exe 38 PID 2180 wrote to memory of 2808 2180 ade246761993caf20eef1a329e981320N.exe 40 PID 2180 wrote to memory of 2808 2180 ade246761993caf20eef1a329e981320N.exe 40 PID 2180 wrote to memory of 2808 2180 ade246761993caf20eef1a329e981320N.exe 40 PID 2180 wrote to memory of 2808 2180 ade246761993caf20eef1a329e981320N.exe 40 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 2180 wrote to memory of 2812 2180 ade246761993caf20eef1a329e981320N.exe 41 PID 1344 wrote to memory of 1756 1344 cmd.exe 43 PID 1344 wrote to memory of 1756 1344 cmd.exe 43 PID 1344 wrote to memory of 1756 1344 cmd.exe 43 PID 1344 wrote to memory of 1756 1344 cmd.exe 43 PID 2500 wrote to memory of 2756 2500 cmd.exe 44 PID 2500 wrote to memory of 2756 2500 cmd.exe 44 PID 2500 wrote to memory of 2756 2500 cmd.exe 44 PID 2500 wrote to memory of 2756 2500 cmd.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ade245651893caf20eef1a329e971320N.exe"C:\Users\Admin\AppData\Local\Temp\ade245651893caf20eef1a329e971320N.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2756
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:1756
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵PID:1168
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\ade246761993caf20eef1a329e981320N.exeC:\Users\Admin\AppData\Roaming\WinSocket\ade246761993caf20eef1a329e981320N.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵PID:2724
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵PID:1944
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
PID:2712
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵PID:2808
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2812
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EC20C049-3416-40D4-AD5B-EAAA2F0F22AE} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2548
-
C:\Users\Admin\AppData\Roaming\WinSocket\ade246761993caf20eef1a329e981320N.exeC:\Users\Admin\AppData\Roaming\WinSocket\ade246761993caf20eef1a329e981320N.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2052 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3036
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD52e79e7980ef46b62400f419f95cd29ca
SHA19731c96bdae3e8fd59d5208b1ef7c47907a95a97
SHA2565c9d8efdb0ee426ff8fc403971c319644205a562f3c33b0d14ea0dda8ba411fb
SHA512736d456bc931728ee627145bc62e546c62add673ad896c987bffdc5d8d177f787d70927a86d54f23937b54d80d77d724cb0175592e3d22989fea83fda9132cdb
-
Filesize
1.2MB
MD5ade245651893caf20eef1a329e971320
SHA12ea7929a8e1c498c9d2dcb5b283507f50dd1c26f
SHA2569349eeab73ffe8ecb2a6cfd10d61c32bc122afbe867ac20d169016f97ffb7412
SHA51298fdac86f7b28a29668490569adce643ddf2288cb051696d8f99f3b8a4bd71e837552dfb8523d45f618824a559626c5fd7575eef03f737d58635320dbd8b94e6