Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2024 00:12
Behavioral task
behavioral1
Sample
31a7a9f4c1bd6878ebb032628250dec0N.exe
Resource
win7-20240704-en
General
-
Target
31a7a9f4c1bd6878ebb032628250dec0N.exe
-
Size
871KB
-
MD5
31a7a9f4c1bd6878ebb032628250dec0
-
SHA1
d20398e3e8a6bfb25ac136aaa4e5e7d85531028a
-
SHA256
cec69ba4d60812f179738c43bf37d4af423a4796bf67fcde41d963e2b475f689
-
SHA512
e559314167874c5ceb6f2209761f693a9d129a4abe6f467a15c68abaf89228ec87c91972e41d2b5dee9034b9ac80ffdda294c011948aa0e3387c078c9dccd3a4
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8Gl4:zQ5aILMCfmAUjzX6xQGCZLFdGm13J4
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234e6-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/8-15-0x0000000002AD0000-0x0000000002AF9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31a7a9f4c1bd6878ebb032628250dec0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31a8a9f4c1bd7989ebb032729260dec0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31a8a9f4c1bd7989ebb032729260dec0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 8 31a7a9f4c1bd6878ebb032628250dec0N.exe 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 8 wrote to memory of 2904 8 31a7a9f4c1bd6878ebb032628250dec0N.exe 84 PID 8 wrote to memory of 2904 8 31a7a9f4c1bd6878ebb032628250dec0N.exe 84 PID 8 wrote to memory of 2904 8 31a7a9f4c1bd6878ebb032628250dec0N.exe 84 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2904 wrote to memory of 1608 2904 31a8a9f4c1bd7989ebb032729260dec0N.exe 85 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 PID 2532 wrote to memory of 1744 2532 31a8a9f4c1bd7989ebb032729260dec0N.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\31a7a9f4c1bd6878ebb032628250dec0N.exe"C:\Users\Admin\AppData\Local\Temp\31a7a9f4c1bd6878ebb032628250dec0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Roaming\WinSocket\31a8a9f4c1bd7989ebb032729260dec0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\31a8a9f4c1bd7989ebb032729260dec0N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1608
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\31a8a9f4c1bd7989ebb032729260dec0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\31a8a9f4c1bd7989ebb032729260dec0N.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:1744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
871KB
MD531a7a9f4c1bd6878ebb032628250dec0
SHA1d20398e3e8a6bfb25ac136aaa4e5e7d85531028a
SHA256cec69ba4d60812f179738c43bf37d4af423a4796bf67fcde41d963e2b475f689
SHA512e559314167874c5ceb6f2209761f693a9d129a4abe6f467a15c68abaf89228ec87c91972e41d2b5dee9034b9ac80ffdda294c011948aa0e3387c078c9dccd3a4