Analysis
-
max time kernel
70s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07-08-2024 11:59
Behavioral task
behavioral1
Sample
bb8192575ea55bd844929ccfbf2de4c0N.exe
Resource
win7-20240708-en
General
-
Target
bb8192575ea55bd844929ccfbf2de4c0N.exe
-
Size
886KB
-
MD5
bb8192575ea55bd844929ccfbf2de4c0
-
SHA1
110c4aa860e2f79a9c18dcfb9dd42edfa680dd01
-
SHA256
cb6d6d67faec7f86a725b0e7871a88404830dff43e47a42222f65f988b9aed2a
-
SHA512
6eeba8edaff136f76e971da013fc40a3b2bc511d881a445749a3d6c0a4811a84b8d2f4629435bc22fd1d1f70ed42a1d385846d1af47f042945bb764fe05240f5
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8GlfZTV:zQ5aILMCfmAUjzX6xQGCZLFdGm13JfZ5
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x00080000000173b8-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/112-15-0x00000000003B0000-0x00000000003D9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 480 bb9192686ea66bd944929ccfbf2de4c0N.exe -
Loads dropped DLL 2 IoCs
pid Process 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 112 bb8192575ea55bd844929ccfbf2de4c0N.exe -
pid Process 2668 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1700 sc.exe 2548 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb8192575ea55bd844929ccfbf2de4c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb9192686ea66bd944929ccfbf2de4c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb9192686ea66bd944929ccfbf2de4c0N.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 2668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2668 powershell.exe Token: SeTcbPrivilege 480 bb9192686ea66bd944929ccfbf2de4c0N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 480 bb9192686ea66bd944929ccfbf2de4c0N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 112 wrote to memory of 2688 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 30 PID 112 wrote to memory of 2688 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 30 PID 112 wrote to memory of 2688 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 30 PID 112 wrote to memory of 2688 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 30 PID 112 wrote to memory of 2788 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 31 PID 112 wrote to memory of 2788 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 31 PID 112 wrote to memory of 2788 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 31 PID 112 wrote to memory of 2788 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 31 PID 112 wrote to memory of 2168 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 33 PID 112 wrote to memory of 2168 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 33 PID 112 wrote to memory of 2168 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 33 PID 112 wrote to memory of 2168 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 33 PID 112 wrote to memory of 3056 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 36 PID 112 wrote to memory of 3056 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 36 PID 112 wrote to memory of 3056 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 36 PID 112 wrote to memory of 3056 112 bb8192575ea55bd844929ccfbf2de4c0N.exe 36 PID 2788 wrote to memory of 1700 2788 cmd.exe 37 PID 2788 wrote to memory of 1700 2788 cmd.exe 37 PID 2788 wrote to memory of 1700 2788 cmd.exe 37 PID 2788 wrote to memory of 1700 2788 cmd.exe 37 PID 2168 wrote to memory of 2668 2168 cmd.exe 38 PID 2168 wrote to memory of 2668 2168 cmd.exe 38 PID 2168 wrote to memory of 2668 2168 cmd.exe 38 PID 2168 wrote to memory of 2668 2168 cmd.exe 38 PID 2688 wrote to memory of 2548 2688 cmd.exe 39 PID 2688 wrote to memory of 2548 2688 cmd.exe 39 PID 2688 wrote to memory of 2548 2688 cmd.exe 39 PID 2688 wrote to memory of 2548 2688 cmd.exe 39 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 3056 wrote to memory of 1656 3056 bb9192686ea66bd944929ccfbf2de4c0N.exe 40 PID 772 wrote to memory of 480 772 taskeng.exe 42 PID 772 wrote to memory of 480 772 taskeng.exe 42 PID 772 wrote to memory of 480 772 taskeng.exe 42 PID 772 wrote to memory of 480 772 taskeng.exe 42 PID 480 wrote to memory of 1708 480 bb9192686ea66bd944929ccfbf2de4c0N.exe 43 PID 480 wrote to memory of 1708 480 bb9192686ea66bd944929ccfbf2de4c0N.exe 43 PID 480 wrote to memory of 1708 480 bb9192686ea66bd944929ccfbf2de4c0N.exe 43 PID 480 wrote to memory of 1708 480 bb9192686ea66bd944929ccfbf2de4c0N.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb8192575ea55bd844929ccfbf2de4c0N.exe"C:\Users\Admin\AppData\Local\Temp\bb8192575ea55bd844929ccfbf2de4c0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\bb9192686ea66bd944929ccfbf2de4c0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\bb9192686ea66bd944929ccfbf2de4c0N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1656
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A5EB61D4-A192-4FDE-A8C2-9E591334E65C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Roaming\WinSocket\bb9192686ea66bd944929ccfbf2de4c0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\bb9192686ea66bd944929ccfbf2de4c0N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1708
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
886KB
MD5bb8192575ea55bd844929ccfbf2de4c0
SHA1110c4aa860e2f79a9c18dcfb9dd42edfa680dd01
SHA256cb6d6d67faec7f86a725b0e7871a88404830dff43e47a42222f65f988b9aed2a
SHA5126eeba8edaff136f76e971da013fc40a3b2bc511d881a445749a3d6c0a4811a84b8d2f4629435bc22fd1d1f70ed42a1d385846d1af47f042945bb764fe05240f5