Analysis
-
max time kernel
70s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 06:29
Behavioral task
behavioral1
Sample
59b2a1a4c240ba403d354b7005735200N.exe
Resource
win7-20240708-en
General
-
Target
59b2a1a4c240ba403d354b7005735200N.exe
-
Size
1.1MB
-
MD5
59b2a1a4c240ba403d354b7005735200
-
SHA1
4a754637effa40f1e7dfff31d9bf4cffbaba0ea9
-
SHA256
17d15d91f649622327d9b853073d39770ed240461c71f3b19c5734e954bf5b40
-
SHA512
7b6f7fc75c77506364fd0387616b11816c714289408394bf082fca5c9f93a7eaa8a6e7879fc577fc32adb7cce215269841517e50a78a3d976622bd316b76669b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9+s8juCCA4:E5aIwC+Agr6SNasrsFCM
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x00080000000187ac-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2384-15-0x0000000000330000-0x0000000000359000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 1968 69b2a1a4c240ba403d364b8006836200N.exe 2072 69b2a1a4c240ba403d364b8006836200N.exe -
Loads dropped DLL 2 IoCs
pid Process 2384 59b2a1a4c240ba403d354b7005735200N.exe 2384 59b2a1a4c240ba403d354b7005735200N.exe -
pid Process 2908 powershell.exe 2676 powershell.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2816 sc.exe 2820 sc.exe 2732 sc.exe 2504 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69b2a1a4c240ba403d364b8006836200N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69b2a1a4c240ba403d364b8006836200N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59b2a1a4c240ba403d354b7005735200N.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2384 59b2a1a4c240ba403d354b7005735200N.exe 2384 59b2a1a4c240ba403d354b7005735200N.exe 2384 59b2a1a4c240ba403d354b7005735200N.exe 1968 69b2a1a4c240ba403d364b8006836200N.exe 1968 69b2a1a4c240ba403d364b8006836200N.exe 1968 69b2a1a4c240ba403d364b8006836200N.exe 2676 powershell.exe 2908 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2908 powershell.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeTcbPrivilege 2072 69b2a1a4c240ba403d364b8006836200N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2384 59b2a1a4c240ba403d354b7005735200N.exe 1968 69b2a1a4c240ba403d364b8006836200N.exe 2072 69b2a1a4c240ba403d364b8006836200N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2572 2384 59b2a1a4c240ba403d354b7005735200N.exe 30 PID 2384 wrote to memory of 2572 2384 59b2a1a4c240ba403d354b7005735200N.exe 30 PID 2384 wrote to memory of 2572 2384 59b2a1a4c240ba403d354b7005735200N.exe 30 PID 2384 wrote to memory of 2572 2384 59b2a1a4c240ba403d354b7005735200N.exe 30 PID 2384 wrote to memory of 2404 2384 59b2a1a4c240ba403d354b7005735200N.exe 31 PID 2384 wrote to memory of 2404 2384 59b2a1a4c240ba403d354b7005735200N.exe 31 PID 2384 wrote to memory of 2404 2384 59b2a1a4c240ba403d354b7005735200N.exe 31 PID 2384 wrote to memory of 2404 2384 59b2a1a4c240ba403d354b7005735200N.exe 31 PID 2384 wrote to memory of 1980 2384 59b2a1a4c240ba403d354b7005735200N.exe 33 PID 2384 wrote to memory of 1980 2384 59b2a1a4c240ba403d354b7005735200N.exe 33 PID 2384 wrote to memory of 1980 2384 59b2a1a4c240ba403d354b7005735200N.exe 33 PID 2384 wrote to memory of 1980 2384 59b2a1a4c240ba403d354b7005735200N.exe 33 PID 2384 wrote to memory of 1968 2384 59b2a1a4c240ba403d354b7005735200N.exe 36 PID 2384 wrote to memory of 1968 2384 59b2a1a4c240ba403d354b7005735200N.exe 36 PID 2384 wrote to memory of 1968 2384 59b2a1a4c240ba403d354b7005735200N.exe 36 PID 2384 wrote to memory of 1968 2384 59b2a1a4c240ba403d354b7005735200N.exe 36 PID 2404 wrote to memory of 2820 2404 cmd.exe 37 PID 2404 wrote to memory of 2820 2404 cmd.exe 37 PID 2404 wrote to memory of 2820 2404 cmd.exe 37 PID 2404 wrote to memory of 2820 2404 cmd.exe 37 PID 2572 wrote to memory of 2816 2572 cmd.exe 38 PID 2572 wrote to memory of 2816 2572 cmd.exe 38 PID 2572 wrote to memory of 2816 2572 cmd.exe 38 PID 2572 wrote to memory of 2816 2572 cmd.exe 38 PID 1980 wrote to memory of 2908 1980 cmd.exe 39 PID 1980 wrote to memory of 2908 1980 cmd.exe 39 PID 1980 wrote to memory of 2908 1980 cmd.exe 39 PID 1980 wrote to memory of 2908 1980 cmd.exe 39 PID 1968 wrote to memory of 2912 1968 69b2a1a4c240ba403d364b8006836200N.exe 40 PID 1968 wrote to memory of 2912 1968 69b2a1a4c240ba403d364b8006836200N.exe 40 PID 1968 wrote to memory of 2912 1968 69b2a1a4c240ba403d364b8006836200N.exe 40 PID 1968 wrote to memory of 2912 1968 69b2a1a4c240ba403d364b8006836200N.exe 40 PID 1968 wrote to memory of 2924 1968 69b2a1a4c240ba403d364b8006836200N.exe 41 PID 1968 wrote to memory of 2924 1968 69b2a1a4c240ba403d364b8006836200N.exe 41 PID 1968 wrote to memory of 2924 1968 69b2a1a4c240ba403d364b8006836200N.exe 41 PID 1968 wrote to memory of 2924 1968 69b2a1a4c240ba403d364b8006836200N.exe 41 PID 1968 wrote to memory of 2476 1968 69b2a1a4c240ba403d364b8006836200N.exe 42 PID 1968 wrote to memory of 2476 1968 69b2a1a4c240ba403d364b8006836200N.exe 42 PID 1968 wrote to memory of 2476 1968 69b2a1a4c240ba403d364b8006836200N.exe 42 PID 1968 wrote to memory of 2476 1968 69b2a1a4c240ba403d364b8006836200N.exe 42 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 PID 1968 wrote to memory of 1696 1968 69b2a1a4c240ba403d364b8006836200N.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b2a1a4c240ba403d354b7005735200N.exe"C:\Users\Admin\AppData\Local\Temp\59b2a1a4c240ba403d354b7005735200N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2816
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\69b2a1a4c240ba403d364b8006836200N.exeC:\Users\Admin\AppData\Roaming\WinSocket\69b2a1a4c240ba403d364b8006836200N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2504
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1696
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {99D02B42-2173-4137-9107-733557F25A58} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2236
-
C:\Users\Admin\AppData\Roaming\WinSocket\69b2a1a4c240ba403d364b8006836200N.exeC:\Users\Admin\AppData\Roaming\WinSocket\69b2a1a4c240ba403d364b8006836200N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2948
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD50f1387acab3a7a64e48d05db30d70a07
SHA194c70ccf0ce440cbb7737d9bd2e0875279a2cc38
SHA256ff73d624017f2bb3ef87f1b19214fb504f30531480750065cc332cc9f6215db3
SHA512e2cfb447277bfc6802c560be1ce87cbaafd3ec2827a37573d2e243f9d39dae007f2b1370f0db4739681b4ffb7dfa8f5079342cbeb04e5dc3991ce0ab80da1f75
-
Filesize
1.1MB
MD559b2a1a4c240ba403d354b7005735200
SHA14a754637effa40f1e7dfff31d9bf4cffbaba0ea9
SHA25617d15d91f649622327d9b853073d39770ed240461c71f3b19c5734e954bf5b40
SHA5127b6f7fc75c77506364fd0387616b11816c714289408394bf082fca5c9f93a7eaa8a6e7879fc577fc32adb7cce215269841517e50a78a3d976622bd316b76669b