Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 15:26
Behavioral task
behavioral1
Sample
db3e99d332bdd6207b7e01d30c013ae0N.exe
Resource
win7-20240708-en
General
-
Target
db3e99d332bdd6207b7e01d30c013ae0N.exe
-
Size
1.4MB
-
MD5
db3e99d332bdd6207b7e01d30c013ae0
-
SHA1
158d747482ddc1ffb1066123e2fdb5378bf52c49
-
SHA256
65b06308a80f1ecab4582541a6a3f27cc5b4783a2ea9878e04cb20f6b0d9d474
-
SHA512
a54da15bcdb63b5fc65e40712196c32ef040102f5fb8c6baeed10572a48bbba2b28ba7a7482320fe57350f824f307c8b6f6583002a70fe78451cfa74d07f1fdf
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQtpj/Yz6XVSvmHaZkI+oq6dTnHv5yIi734DHr0ESjdk5:E5aIwC+Agr6St1lOqq+jCpLWe
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016d6b-25.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/1288-15-0x0000000001E10000-0x0000000001E39000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 1300 db3e99d332bdd7208b8e01d30c013ae0N.exe -
Loads dropped DLL 2 IoCs
pid Process 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe -
pid Process 2308 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2848 sc.exe 2824 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db3e99d332bdd7208b8e01d30c013ae0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db3e99d332bdd6207b7e01d30c013ae0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db3e99d332bdd7208b8e01d30c013ae0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 2308 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2308 powershell.exe Token: SeTcbPrivilege 1300 db3e99d332bdd7208b8e01d30c013ae0N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 1300 db3e99d332bdd7208b8e01d30c013ae0N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1992 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 30 PID 1288 wrote to memory of 1992 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 30 PID 1288 wrote to memory of 1992 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 30 PID 1288 wrote to memory of 1992 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 30 PID 1288 wrote to memory of 348 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 31 PID 1288 wrote to memory of 348 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 31 PID 1288 wrote to memory of 348 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 31 PID 1288 wrote to memory of 348 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 31 PID 1288 wrote to memory of 2264 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 32 PID 1288 wrote to memory of 2264 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 32 PID 1288 wrote to memory of 2264 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 32 PID 1288 wrote to memory of 2264 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 32 PID 1288 wrote to memory of 1620 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 36 PID 1288 wrote to memory of 1620 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 36 PID 1288 wrote to memory of 1620 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 36 PID 1288 wrote to memory of 1620 1288 db3e99d332bdd6207b7e01d30c013ae0N.exe 36 PID 348 wrote to memory of 2824 348 cmd.exe 37 PID 348 wrote to memory of 2824 348 cmd.exe 37 PID 348 wrote to memory of 2824 348 cmd.exe 37 PID 348 wrote to memory of 2824 348 cmd.exe 37 PID 1992 wrote to memory of 2848 1992 cmd.exe 38 PID 1992 wrote to memory of 2848 1992 cmd.exe 38 PID 1992 wrote to memory of 2848 1992 cmd.exe 38 PID 1992 wrote to memory of 2848 1992 cmd.exe 38 PID 2264 wrote to memory of 2308 2264 cmd.exe 39 PID 2264 wrote to memory of 2308 2264 cmd.exe 39 PID 2264 wrote to memory of 2308 2264 cmd.exe 39 PID 2264 wrote to memory of 2308 2264 cmd.exe 39 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1620 wrote to memory of 2644 1620 db3e99d332bdd7208b8e01d30c013ae0N.exe 40 PID 1480 wrote to memory of 1300 1480 taskeng.exe 43 PID 1480 wrote to memory of 1300 1480 taskeng.exe 43 PID 1480 wrote to memory of 1300 1480 taskeng.exe 43 PID 1480 wrote to memory of 1300 1480 taskeng.exe 43 PID 1300 wrote to memory of 2648 1300 db3e99d332bdd7208b8e01d30c013ae0N.exe 44 PID 1300 wrote to memory of 2648 1300 db3e99d332bdd7208b8e01d30c013ae0N.exe 44 PID 1300 wrote to memory of 2648 1300 db3e99d332bdd7208b8e01d30c013ae0N.exe 44 PID 1300 wrote to memory of 2648 1300 db3e99d332bdd7208b8e01d30c013ae0N.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\db3e99d332bdd6207b7e01d30c013ae0N.exe"C:\Users\Admin\AppData\Local\Temp\db3e99d332bdd6207b7e01d30c013ae0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\db3e99d332bdd7208b8e01d30c013ae0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\db3e99d332bdd7208b8e01d30c013ae0N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2644
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D10AA6FB-BD81-4CA2-9D16-BDC51CFD780D} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Roaming\WinSocket\db3e99d332bdd7208b8e01d30c013ae0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\db3e99d332bdd7208b8e01d30c013ae0N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5db3e99d332bdd6207b7e01d30c013ae0
SHA1158d747482ddc1ffb1066123e2fdb5378bf52c49
SHA25665b06308a80f1ecab4582541a6a3f27cc5b4783a2ea9878e04cb20f6b0d9d474
SHA512a54da15bcdb63b5fc65e40712196c32ef040102f5fb8c6baeed10572a48bbba2b28ba7a7482320fe57350f824f307c8b6f6583002a70fe78451cfa74d07f1fdf