Analysis
-
max time kernel
134s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 23:51
Behavioral task
behavioral1
Sample
8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe
Resource
win7-20240705-en
General
-
Target
8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe
-
Size
1.2MB
-
MD5
97494469f4b95f3adc4eed85130cd565
-
SHA1
e5ca2a5fdf3b7849e636129976d28d94f36107a3
-
SHA256
8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977
-
SHA512
785437d00a6b1d0f4c3d285b03bac404aeff42b279576806422f8f38135648cf8baae03937457d1fb4c9064da5d9835d04bb7150aff9624881e706ad159df07b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU95QyILOHgl:E5aIwC+Agr6SNasOqD
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000015cf9-26.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/3040-15-0x00000000023F0000-0x0000000002419000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 2876 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 1480 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe -
Loads dropped DLL 2 IoCs
pid Process 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe -
pid Process 2092 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2528 sc.exe 2244 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 2092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2092 powershell.exe Token: SeTcbPrivilege 2876 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe Token: SeTcbPrivilege 1480 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 2876 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 1480 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2368 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 30 PID 3040 wrote to memory of 2368 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 30 PID 3040 wrote to memory of 2368 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 30 PID 3040 wrote to memory of 2368 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 30 PID 3040 wrote to memory of 2376 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 31 PID 3040 wrote to memory of 2376 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 31 PID 3040 wrote to memory of 2376 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 31 PID 3040 wrote to memory of 2376 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 31 PID 3040 wrote to memory of 1516 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 33 PID 3040 wrote to memory of 1516 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 33 PID 3040 wrote to memory of 1516 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 33 PID 3040 wrote to memory of 1516 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 33 PID 2376 wrote to memory of 2528 2376 cmd.exe 37 PID 2376 wrote to memory of 2528 2376 cmd.exe 37 PID 2376 wrote to memory of 2528 2376 cmd.exe 37 PID 2376 wrote to memory of 2528 2376 cmd.exe 37 PID 3040 wrote to memory of 2168 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 36 PID 3040 wrote to memory of 2168 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 36 PID 3040 wrote to memory of 2168 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 36 PID 3040 wrote to memory of 2168 3040 8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe 36 PID 2368 wrote to memory of 2244 2368 cmd.exe 38 PID 2368 wrote to memory of 2244 2368 cmd.exe 38 PID 2368 wrote to memory of 2244 2368 cmd.exe 38 PID 2368 wrote to memory of 2244 2368 cmd.exe 38 PID 1516 wrote to memory of 2092 1516 cmd.exe 39 PID 1516 wrote to memory of 2092 1516 cmd.exe 39 PID 1516 wrote to memory of 2092 1516 cmd.exe 39 PID 1516 wrote to memory of 2092 1516 cmd.exe 39 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2168 wrote to memory of 2588 2168 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 40 PID 2672 wrote to memory of 2876 2672 taskeng.exe 42 PID 2672 wrote to memory of 2876 2672 taskeng.exe 42 PID 2672 wrote to memory of 2876 2672 taskeng.exe 42 PID 2672 wrote to memory of 2876 2672 taskeng.exe 42 PID 2876 wrote to memory of 2252 2876 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 43 PID 2876 wrote to memory of 2252 2876 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 43 PID 2876 wrote to memory of 2252 2876 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 43 PID 2876 wrote to memory of 2252 2876 9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe"C:\Users\Admin\AppData\Local\Temp\8a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2244
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exeC:\Users\Admin\AppData\Roaming\WinSocket\9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2588
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {2F456687-F30C-448B-A69F-CFD90F281368} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Roaming\WinSocket\9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exeC:\Users\Admin\AppData\Roaming\WinSocket\9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2252
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exeC:\Users\Admin\AppData\Roaming\WinSocket\9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1480 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1484
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\9a4207d8ebeb692970960292ebb9c31dd393a1aec20c8d8f1e4eb91e90f98988.exe
Filesize1.2MB
MD597494469f4b95f3adc4eed85130cd565
SHA1e5ca2a5fdf3b7849e636129976d28d94f36107a3
SHA2568a4206d7ebeb582860850292ebb9c31dd383a1aec20c7d7f1e4eb91e90f87977
SHA512785437d00a6b1d0f4c3d285b03bac404aeff42b279576806422f8f38135648cf8baae03937457d1fb4c9064da5d9835d04bb7150aff9624881e706ad159df07b