Analysis
-
max time kernel
114s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2024 00:32
Behavioral task
behavioral1
Sample
e97bbd2ee0aa440c035ede21e0915f30N.exe
Resource
win7-20240704-en
General
-
Target
e97bbd2ee0aa440c035ede21e0915f30N.exe
-
Size
1.4MB
-
MD5
e97bbd2ee0aa440c035ede21e0915f30
-
SHA1
58be6c23488c5a1fc834fa8a7f4cdc5dacfe9c05
-
SHA256
173ac27d3f21ad1752112bf2d70b06c6f6424edddafaa85f174bd346ac14ce91
-
SHA512
3c194ca0dd625c6d97c65cbe7fa35de5c7fd3c9e616179de491e68ff4122b6894613162d5d782255f05ae16d09b90627e8cc371c3bb2ed58cfaa3779bc45c947
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQtpj/Yz6XVSvmHaZkI+oq6dTnHv5yIi734DHr0ESjdkdL:E5aIwC+Agr6St1lOqq+jCpLWuL
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234be-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/864-16-0x0000000002D00000-0x0000000002D29000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e97bbd2ee0aa440c035ede21e0915f30N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e98bbd2ee0aa440c036ede21e0916f30N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e98bbd2ee0aa440c036ede21e0916f30N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 864 e97bbd2ee0aa440c035ede21e0915f30N.exe 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 864 wrote to memory of 3392 864 e97bbd2ee0aa440c035ede21e0915f30N.exe 84 PID 864 wrote to memory of 3392 864 e97bbd2ee0aa440c035ede21e0915f30N.exe 84 PID 864 wrote to memory of 3392 864 e97bbd2ee0aa440c035ede21e0915f30N.exe 84 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 3392 wrote to memory of 2416 3392 e98bbd2ee0aa440c036ede21e0916f30N.exe 85 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 PID 1800 wrote to memory of 4764 1800 e98bbd2ee0aa440c036ede21e0916f30N.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e97bbd2ee0aa440c035ede21e0915f30N.exe"C:\Users\Admin\AppData\Local\Temp\e97bbd2ee0aa440c035ede21e0915f30N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Roaming\WinSocket\e98bbd2ee0aa440c036ede21e0916f30N.exeC:\Users\Admin\AppData\Roaming\WinSocket\e98bbd2ee0aa440c036ede21e0916f30N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2416
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\e98bbd2ee0aa440c036ede21e0916f30N.exeC:\Users\Admin\AppData\Roaming\WinSocket\e98bbd2ee0aa440c036ede21e0916f30N.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5e97bbd2ee0aa440c035ede21e0915f30
SHA158be6c23488c5a1fc834fa8a7f4cdc5dacfe9c05
SHA256173ac27d3f21ad1752112bf2d70b06c6f6424edddafaa85f174bd346ac14ce91
SHA5123c194ca0dd625c6d97c65cbe7fa35de5c7fd3c9e616179de491e68ff4122b6894613162d5d782255f05ae16d09b90627e8cc371c3bb2ed58cfaa3779bc45c947