Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24-08-2024 10:35

General

  • Target

    a90cb60a7894ecc28d5be3ad83ea15a0N.exe

  • Size

    1.3MB

  • MD5

    a90cb60a7894ecc28d5be3ad83ea15a0

  • SHA1

    26832a83c7ac748809aa495561c7ab6c09011ac6

  • SHA256

    510a2c74eb7ffb7f81747c6bfc9df95717386af59f45fbe9b895318aa3b88508

  • SHA512

    22270da1485ef3417b2fa641870942b459b7604944c193e3920946c8d2860c4faf5930f2f6a0a213389d31ad9404b4086682bd4d43e81d1c857cdd0eeb2a5db0

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9+sEDm1xzBZMhzNX:E5aIwC+Agr6SNasrsQm7BZczR

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a90cb60a7894ecc28d5be3ad83ea15a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\a90cb60a7894ecc28d5be3ad83ea15a0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\SysWOW64\cmd.exe
      /c sc stop WinDefend
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2584
    • C:\Windows\SysWOW64\cmd.exe
      /c sc delete WinDefend
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\SysWOW64\sc.exe
        sc delete WinDefend
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2664
    • C:\Windows\SysWOW64\cmd.exe
      /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2712
    • C:\Users\Admin\AppData\Roaming\WinSocket\a90cb70a8994ecc29d6be3ad93ea16a0N.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\a90cb70a8994ecc29d6be3ad93ea16a0N.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:572
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {A2E62E76-8405-4686-A49D-D389F801EF3E} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Users\Admin\AppData\Roaming\WinSocket\a90cb70a8994ecc29d6be3ad93ea16a0N.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\a90cb70a8994ecc29d6be3ad93ea16a0N.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
            PID:2444

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Roaming\WinSocket\a90cb70a8994ecc29d6be3ad93ea16a0N.exe

        Filesize

        1.3MB

        MD5

        a90cb60a7894ecc28d5be3ad83ea15a0

        SHA1

        26832a83c7ac748809aa495561c7ab6c09011ac6

        SHA256

        510a2c74eb7ffb7f81747c6bfc9df95717386af59f45fbe9b895318aa3b88508

        SHA512

        22270da1485ef3417b2fa641870942b459b7604944c193e3920946c8d2860c4faf5930f2f6a0a213389d31ad9404b4086682bd4d43e81d1c857cdd0eeb2a5db0

      • memory/572-52-0x0000000010000000-0x000000001001E000-memory.dmp

        Filesize

        120KB

      • memory/572-50-0x0000000000060000-0x0000000000061000-memory.dmp

        Filesize

        4KB

      • memory/572-51-0x0000000010000000-0x000000001001E000-memory.dmp

        Filesize

        120KB

      • memory/1912-70-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-73-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-66-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-67-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-65-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-64-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-63-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-69-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-68-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-71-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-72-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/1912-74-0x0000000000510000-0x0000000000511000-memory.dmp

        Filesize

        4KB

      • memory/2780-12-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-15-0x00000000002A0000-0x00000000002C9000-memory.dmp

        Filesize

        164KB

      • memory/2780-5-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-3-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-17-0x0000000000421000-0x0000000000422000-memory.dmp

        Filesize

        4KB

      • memory/2780-18-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2780-2-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-4-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-6-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-14-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-10-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-13-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-11-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-7-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-8-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2780-9-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2864-41-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-30-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-31-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-32-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-33-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-34-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-35-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-36-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-37-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-38-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-39-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-40-0x0000000000200000-0x0000000000201000-memory.dmp

        Filesize

        4KB

      • memory/2864-45-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2864-46-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2864-44-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.