Analysis
-
max time kernel
71s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-08-2024 20:09
Behavioral task
behavioral1
Sample
65c8b3a4a14095d91fe9346cc81eb190N.exe
Resource
win7-20240704-en
General
-
Target
65c8b3a4a14095d91fe9346cc81eb190N.exe
-
Size
1.4MB
-
MD5
65c8b3a4a14095d91fe9346cc81eb190
-
SHA1
7b2ff61b779e7c3d1312d9edf23b79155697b701
-
SHA256
680a36979824ada6163d67bbd22fc9dbb4b6a5a699e08cacec7cfaa7ecbc97d2
-
SHA512
1cdf8c28e127dc29bf8353cc42d649ce55fbe4d6e6b7440891777821786d30cb01de26634e700ec6041857194a166166c1841e8cadcef3a204f9598afb69aafc
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQtpj/Yz6XVSvmHaZkI+oq6dTnHv5yIi734DHr0ESjdkrO:E5aIwC+Agr6St1lOqq+jCpLWv
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0006000000018b54-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2348-15-0x00000000002E0000-0x0000000000309000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 3016 76c9b3a4a14096d91fe9347cc91eb190N.exe -
Loads dropped DLL 2 IoCs
pid Process 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe -
pid Process 2724 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2664 sc.exe 2660 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65c8b3a4a14095d91fe9346cc81eb190N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76c9b3a4a14096d91fe9347cc91eb190N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76c9b3a4a14096d91fe9347cc91eb190N.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 2724 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2724 powershell.exe Token: SeTcbPrivilege 3016 76c9b3a4a14096d91fe9347cc91eb190N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 3016 76c9b3a4a14096d91fe9347cc91eb190N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2884 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 29 PID 2348 wrote to memory of 2884 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 29 PID 2348 wrote to memory of 2884 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 29 PID 2348 wrote to memory of 2884 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 29 PID 2348 wrote to memory of 2856 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 30 PID 2348 wrote to memory of 2856 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 30 PID 2348 wrote to memory of 2856 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 30 PID 2348 wrote to memory of 2856 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 30 PID 2348 wrote to memory of 2936 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 32 PID 2348 wrote to memory of 2936 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 32 PID 2348 wrote to memory of 2936 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 32 PID 2348 wrote to memory of 2936 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 32 PID 2348 wrote to memory of 2944 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 35 PID 2348 wrote to memory of 2944 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 35 PID 2348 wrote to memory of 2944 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 35 PID 2348 wrote to memory of 2944 2348 65c8b3a4a14095d91fe9346cc81eb190N.exe 35 PID 2856 wrote to memory of 2664 2856 cmd.exe 36 PID 2856 wrote to memory of 2664 2856 cmd.exe 36 PID 2856 wrote to memory of 2664 2856 cmd.exe 36 PID 2856 wrote to memory of 2664 2856 cmd.exe 36 PID 2936 wrote to memory of 2724 2936 cmd.exe 38 PID 2936 wrote to memory of 2724 2936 cmd.exe 38 PID 2936 wrote to memory of 2724 2936 cmd.exe 38 PID 2936 wrote to memory of 2724 2936 cmd.exe 38 PID 2884 wrote to memory of 2660 2884 cmd.exe 37 PID 2884 wrote to memory of 2660 2884 cmd.exe 37 PID 2884 wrote to memory of 2660 2884 cmd.exe 37 PID 2884 wrote to memory of 2660 2884 cmd.exe 37 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 2944 wrote to memory of 888 2944 76c9b3a4a14096d91fe9347cc91eb190N.exe 39 PID 1332 wrote to memory of 3016 1332 taskeng.exe 41 PID 1332 wrote to memory of 3016 1332 taskeng.exe 41 PID 1332 wrote to memory of 3016 1332 taskeng.exe 41 PID 1332 wrote to memory of 3016 1332 taskeng.exe 41 PID 3016 wrote to memory of 796 3016 76c9b3a4a14096d91fe9347cc91eb190N.exe 42 PID 3016 wrote to memory of 796 3016 76c9b3a4a14096d91fe9347cc91eb190N.exe 42 PID 3016 wrote to memory of 796 3016 76c9b3a4a14096d91fe9347cc91eb190N.exe 42 PID 3016 wrote to memory of 796 3016 76c9b3a4a14096d91fe9347cc91eb190N.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\65c8b3a4a14095d91fe9346cc81eb190N.exe"C:\Users\Admin\AppData\Local\Temp\65c8b3a4a14095d91fe9346cc81eb190N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2660
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2664
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exeC:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:888
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {397DD568-8C01-4D43-9FC7-9EE081E492EC} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exeC:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:796
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD565c8b3a4a14095d91fe9346cc81eb190
SHA17b2ff61b779e7c3d1312d9edf23b79155697b701
SHA256680a36979824ada6163d67bbd22fc9dbb4b6a5a699e08cacec7cfaa7ecbc97d2
SHA5121cdf8c28e127dc29bf8353cc42d649ce55fbe4d6e6b7440891777821786d30cb01de26634e700ec6041857194a166166c1841e8cadcef3a204f9598afb69aafc