Analysis
-
max time kernel
70s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24-08-2024 19:32
Behavioral task
behavioral1
Sample
8b35a9361bac82977892d572c5e1e600N.exe
Resource
win7-20240708-en
General
-
Target
8b35a9361bac82977892d572c5e1e600N.exe
-
Size
1.3MB
-
MD5
8b35a9361bac82977892d572c5e1e600
-
SHA1
1585d62b466c2c9f598de8a68348c9e18d60f546
-
SHA256
a5c2ce8576ecdee9b5018115ce3791a2fad5960939c4a39b88e6d2e96ecefc10
-
SHA512
e13c5f8aa67fa84195d88fb6009ab780016d5d941b54d557d0de3215dc5647f59a1642ce2ff9d2246bef2c3ab1e26a292c11407950889ec47763806d17f2ab6e
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9+sEDm1xzBZMge:E5aIwC+Agr6SNasrsQm7BZa
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x000700000001961f-25.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2732-15-0x00000000003B0000-0x00000000003D9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2720 9b36a9371bac92988992d682c6e1e700N.exe 300 9b36a9371bac92988992d682c6e1e700N.exe -
Loads dropped DLL 2 IoCs
pid Process 2732 8b35a9361bac82977892d572c5e1e600N.exe 2732 8b35a9361bac82977892d572c5e1e600N.exe -
pid Process 2636 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2580 sc.exe 2600 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b35a9361bac82977892d572c5e1e600N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b36a9371bac92988992d682c6e1e700N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b36a9371bac92988992d682c6e1e700N.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2732 8b35a9361bac82977892d572c5e1e600N.exe 2732 8b35a9361bac82977892d572c5e1e600N.exe 2732 8b35a9361bac82977892d572c5e1e600N.exe 2636 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2636 powershell.exe Token: SeTcbPrivilege 300 9b36a9371bac92988992d682c6e1e700N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2732 8b35a9361bac82977892d572c5e1e600N.exe 2720 9b36a9371bac92988992d682c6e1e700N.exe 300 9b36a9371bac92988992d682c6e1e700N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2592 2732 8b35a9361bac82977892d572c5e1e600N.exe 30 PID 2732 wrote to memory of 2592 2732 8b35a9361bac82977892d572c5e1e600N.exe 30 PID 2732 wrote to memory of 2592 2732 8b35a9361bac82977892d572c5e1e600N.exe 30 PID 2732 wrote to memory of 2592 2732 8b35a9361bac82977892d572c5e1e600N.exe 30 PID 2732 wrote to memory of 2260 2732 8b35a9361bac82977892d572c5e1e600N.exe 31 PID 2732 wrote to memory of 2260 2732 8b35a9361bac82977892d572c5e1e600N.exe 31 PID 2732 wrote to memory of 2260 2732 8b35a9361bac82977892d572c5e1e600N.exe 31 PID 2732 wrote to memory of 2260 2732 8b35a9361bac82977892d572c5e1e600N.exe 31 PID 2732 wrote to memory of 2700 2732 8b35a9361bac82977892d572c5e1e600N.exe 32 PID 2732 wrote to memory of 2700 2732 8b35a9361bac82977892d572c5e1e600N.exe 32 PID 2732 wrote to memory of 2700 2732 8b35a9361bac82977892d572c5e1e600N.exe 32 PID 2732 wrote to memory of 2700 2732 8b35a9361bac82977892d572c5e1e600N.exe 32 PID 2732 wrote to memory of 2720 2732 8b35a9361bac82977892d572c5e1e600N.exe 36 PID 2732 wrote to memory of 2720 2732 8b35a9361bac82977892d572c5e1e600N.exe 36 PID 2732 wrote to memory of 2720 2732 8b35a9361bac82977892d572c5e1e600N.exe 36 PID 2732 wrote to memory of 2720 2732 8b35a9361bac82977892d572c5e1e600N.exe 36 PID 2592 wrote to memory of 2600 2592 cmd.exe 37 PID 2592 wrote to memory of 2600 2592 cmd.exe 37 PID 2592 wrote to memory of 2600 2592 cmd.exe 37 PID 2592 wrote to memory of 2600 2592 cmd.exe 37 PID 2260 wrote to memory of 2580 2260 cmd.exe 38 PID 2260 wrote to memory of 2580 2260 cmd.exe 38 PID 2260 wrote to memory of 2580 2260 cmd.exe 38 PID 2260 wrote to memory of 2580 2260 cmd.exe 38 PID 2700 wrote to memory of 2636 2700 cmd.exe 39 PID 2700 wrote to memory of 2636 2700 cmd.exe 39 PID 2700 wrote to memory of 2636 2700 cmd.exe 39 PID 2700 wrote to memory of 2636 2700 cmd.exe 39 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 2720 wrote to memory of 2052 2720 9b36a9371bac92988992d682c6e1e700N.exe 40 PID 836 wrote to memory of 300 836 taskeng.exe 42 PID 836 wrote to memory of 300 836 taskeng.exe 42 PID 836 wrote to memory of 300 836 taskeng.exe 42 PID 836 wrote to memory of 300 836 taskeng.exe 42 PID 300 wrote to memory of 2392 300 9b36a9371bac92988992d682c6e1e700N.exe 43 PID 300 wrote to memory of 2392 300 9b36a9371bac92988992d682c6e1e700N.exe 43 PID 300 wrote to memory of 2392 300 9b36a9371bac92988992d682c6e1e700N.exe 43 PID 300 wrote to memory of 2392 300 9b36a9371bac92988992d682c6e1e700N.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b35a9361bac82977892d572c5e1e600N.exe"C:\Users\Admin\AppData\Local\Temp\8b35a9361bac82977892d572c5e1e600N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\9b36a9371bac92988992d682c6e1e700N.exeC:\Users\Admin\AppData\Roaming\WinSocket\9b36a9371bac92988992d682c6e1e700N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2052
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {12D7B0B8-6C57-428D-A308-9306DE80C771} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Roaming\WinSocket\9b36a9371bac92988992d682c6e1e700N.exeC:\Users\Admin\AppData\Roaming\WinSocket\9b36a9371bac92988992d682c6e1e700N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2392
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD58b35a9361bac82977892d572c5e1e600
SHA11585d62b466c2c9f598de8a68348c9e18d60f546
SHA256a5c2ce8576ecdee9b5018115ce3791a2fad5960939c4a39b88e6d2e96ecefc10
SHA512e13c5f8aa67fa84195d88fb6009ab780016d5d941b54d557d0de3215dc5647f59a1642ce2ff9d2246bef2c3ab1e26a292c11407950889ec47763806d17f2ab6e