Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
07-08-2024 07:41
Behavioral task
behavioral1
Sample
88a8384f25ac2d1f0bac03a8a4257050N.exe
Resource
win7-20240705-en
General
-
Target
88a8384f25ac2d1f0bac03a8a4257050N.exe
-
Size
864KB
-
MD5
88a8384f25ac2d1f0bac03a8a4257050
-
SHA1
d12c707ba6240bca95dfca1fb2fafbeb70b9f3b8
-
SHA256
4f751b4b3027b2aa16ac5c26e1b6bce7409fa28ecc4bbe2bcaf4dad525407d2b
-
SHA512
3e14a709a0e8d21b540bb780c83fba4f6f778d70f1763337ae10d2661ea3bbbdadb1d479720ed084655d45b4917b30ba55d862db1e8b02460fa622512da8f8c0
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8GlvzG:zQ5aILMCfmAUjzX6xQGCZLFdGm13JvzG
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016d55-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2116-15-0x00000000002C0000-0x00000000002E9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 2320 99a9394f26ac2d1f0bac03a9a4268060N.exe -
Loads dropped DLL 2 IoCs
pid Process 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe -
pid Process 2904 powershell.exe 2180 powershell.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2204 sc.exe 2880 sc.exe 2724 sc.exe 1528 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99a9394f26ac2d1f0bac03a9a4268060N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88a8384f25ac2d1f0bac03a8a4257050N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99a9394f26ac2d1f0bac03a9a4268060N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 2904 powershell.exe 2180 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2904 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeTcbPrivilege 2320 99a9394f26ac2d1f0bac03a9a4268060N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 2320 99a9394f26ac2d1f0bac03a9a4268060N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2056 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 30 PID 2116 wrote to memory of 2056 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 30 PID 2116 wrote to memory of 2056 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 30 PID 2116 wrote to memory of 2056 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 30 PID 2116 wrote to memory of 2792 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 31 PID 2116 wrote to memory of 2792 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 31 PID 2116 wrote to memory of 2792 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 31 PID 2116 wrote to memory of 2792 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 31 PID 2116 wrote to memory of 2020 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 33 PID 2116 wrote to memory of 2020 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 33 PID 2116 wrote to memory of 2020 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 33 PID 2116 wrote to memory of 2020 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 33 PID 2116 wrote to memory of 2812 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 36 PID 2116 wrote to memory of 2812 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 36 PID 2116 wrote to memory of 2812 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 36 PID 2116 wrote to memory of 2812 2116 88a8384f25ac2d1f0bac03a8a4257050N.exe 36 PID 2792 wrote to memory of 2880 2792 cmd.exe 37 PID 2792 wrote to memory of 2880 2792 cmd.exe 37 PID 2792 wrote to memory of 2880 2792 cmd.exe 37 PID 2792 wrote to memory of 2880 2792 cmd.exe 37 PID 2020 wrote to memory of 2904 2020 cmd.exe 40 PID 2020 wrote to memory of 2904 2020 cmd.exe 40 PID 2020 wrote to memory of 2904 2020 cmd.exe 40 PID 2020 wrote to memory of 2904 2020 cmd.exe 40 PID 2812 wrote to memory of 2148 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 39 PID 2812 wrote to memory of 2148 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 39 PID 2812 wrote to memory of 2148 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 39 PID 2812 wrote to memory of 2148 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 39 PID 2056 wrote to memory of 2724 2056 cmd.exe 38 PID 2056 wrote to memory of 2724 2056 cmd.exe 38 PID 2056 wrote to memory of 2724 2056 cmd.exe 38 PID 2056 wrote to memory of 2724 2056 cmd.exe 38 PID 2812 wrote to memory of 2628 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 41 PID 2812 wrote to memory of 2628 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 41 PID 2812 wrote to memory of 2628 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 41 PID 2812 wrote to memory of 2628 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 41 PID 2812 wrote to memory of 2960 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 42 PID 2812 wrote to memory of 2960 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 42 PID 2812 wrote to memory of 2960 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 42 PID 2812 wrote to memory of 2960 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 42 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 PID 2812 wrote to memory of 2776 2812 99a9394f26ac2d1f0bac03a9a4268060N.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\88a8384f25ac2d1f0bac03a8a4257050N.exe"C:\Users\Admin\AppData\Local\Temp\88a8384f25ac2d1f0bac03a8a4257050N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2724
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2880
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\99a9394f26ac2d1f0bac03a9a4268060N.exeC:\Users\Admin\AppData\Roaming\WinSocket\99a9394f26ac2d1f0bac03a9a4268060N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2204
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2776
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {028BF4ED-AA7B-4B91-AECE-75B57A5AB357} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2252
-
C:\Users\Admin\AppData\Roaming\WinSocket\99a9394f26ac2d1f0bac03a9a4268060N.exeC:\Users\Admin\AppData\Roaming\WinSocket\99a9394f26ac2d1f0bac03a9a4268060N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5281db15eafc3b7ec39c272939012fb24
SHA167d9f6c24c8ab93a1c779ce1179791f97f9e6895
SHA2568d29cf43bda309273d71c4759a7485132fa8ffe80e6d7e8bbdfe90bf92418fd3
SHA512d4d02c26ac94725fec0282eb756019eefdaa2f3ca868fd1575f29d9eeef8e6aa69c4ff82653a0c32097fffa582b0f24a4c23a3875e69f76014fa369f3d64c124
-
Filesize
864KB
MD588a8384f25ac2d1f0bac03a8a4257050
SHA1d12c707ba6240bca95dfca1fb2fafbeb70b9f3b8
SHA2564f751b4b3027b2aa16ac5c26e1b6bce7409fa28ecc4bbe2bcaf4dad525407d2b
SHA5123e14a709a0e8d21b540bb780c83fba4f6f778d70f1763337ae10d2661ea3bbbdadb1d479720ed084655d45b4917b30ba55d862db1e8b02460fa622512da8f8c0