Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 22:31
Behavioral task
behavioral1
Sample
b1d86beadfcf50854bfd4f52aca45d40N.exe
Resource
win7-20240708-en
General
-
Target
b1d86beadfcf50854bfd4f52aca45d40N.exe
-
Size
1.4MB
-
MD5
b1d86beadfcf50854bfd4f52aca45d40
-
SHA1
2796375adf0b921eb2a82325c9461b45b92c02ce
-
SHA256
f0315de3025cfe20ab7ea1700a212ab8f253bbea72598e4f21db2c4b40e51ac2
-
SHA512
73181475a60069f68c41513bd8b7471750c31ef212b8123b1cbb9f771a71c02c1392aab73a7ba9814d1a95decc4358c96d9ea6a795f794dd9944150f3d453c11
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQtpj/Yz6XVSvmHaZkI+oq6dTnHv5yIi734DHr0ESjdk37L/:E5aIwC+Agr6St1lOqq+jCpLWOX
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x000700000002347b-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/1788-15-0x0000000002270000-0x0000000002299000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1d86beadfcf50854bfd4f52aca45d40N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1d97beadfcf60964bfd4f62aca46d40N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1d97beadfcf60964bfd4f62aca46d40N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1788 b1d86beadfcf50854bfd4f52aca45d40N.exe 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 1788 wrote to memory of 3200 1788 b1d86beadfcf50854bfd4f52aca45d40N.exe 84 PID 1788 wrote to memory of 3200 1788 b1d86beadfcf50854bfd4f52aca45d40N.exe 84 PID 1788 wrote to memory of 3200 1788 b1d86beadfcf50854bfd4f52aca45d40N.exe 84 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 3200 wrote to memory of 2412 3200 b1d97beadfcf60964bfd4f62aca46d40N.exe 85 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 PID 5052 wrote to memory of 4048 5052 b1d97beadfcf60964bfd4f62aca46d40N.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1d86beadfcf50854bfd4f52aca45d40N.exe"C:\Users\Admin\AppData\Local\Temp\b1d86beadfcf50854bfd4f52aca45d40N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Roaming\WinSocket\b1d97beadfcf60964bfd4f62aca46d40N.exeC:\Users\Admin\AppData\Roaming\WinSocket\b1d97beadfcf60964bfd4f62aca46d40N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2412
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\b1d97beadfcf60964bfd4f62aca46d40N.exeC:\Users\Admin\AppData\Roaming\WinSocket\b1d97beadfcf60964bfd4f62aca46d40N.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5b1d86beadfcf50854bfd4f52aca45d40
SHA12796375adf0b921eb2a82325c9461b45b92c02ce
SHA256f0315de3025cfe20ab7ea1700a212ab8f253bbea72598e4f21db2c4b40e51ac2
SHA51273181475a60069f68c41513bd8b7471750c31ef212b8123b1cbb9f771a71c02c1392aab73a7ba9814d1a95decc4358c96d9ea6a795f794dd9944150f3d453c11