Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2024 20:09
Behavioral task
behavioral1
Sample
65c8b3a4a14095d91fe9346cc81eb190N.exe
Resource
win7-20240704-en
General
-
Target
65c8b3a4a14095d91fe9346cc81eb190N.exe
-
Size
1.4MB
-
MD5
65c8b3a4a14095d91fe9346cc81eb190
-
SHA1
7b2ff61b779e7c3d1312d9edf23b79155697b701
-
SHA256
680a36979824ada6163d67bbd22fc9dbb4b6a5a699e08cacec7cfaa7ecbc97d2
-
SHA512
1cdf8c28e127dc29bf8353cc42d649ce55fbe4d6e6b7440891777821786d30cb01de26634e700ec6041857194a166166c1841e8cadcef3a204f9598afb69aafc
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQtpj/Yz6XVSvmHaZkI+oq6dTnHv5yIi734DHr0ESjdkrO:E5aIwC+Agr6St1lOqq+jCpLWv
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234cc-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/1456-16-0x0000000002AF0000-0x0000000002B19000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76c9b3a4a14096d91fe9347cc91eb190N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76c9b3a4a14096d91fe9347cc91eb190N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65c8b3a4a14095d91fe9346cc81eb190N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1456 65c8b3a4a14095d91fe9346cc81eb190N.exe 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 1456 wrote to memory of 5116 1456 65c8b3a4a14095d91fe9346cc81eb190N.exe 84 PID 1456 wrote to memory of 5116 1456 65c8b3a4a14095d91fe9346cc81eb190N.exe 84 PID 1456 wrote to memory of 5116 1456 65c8b3a4a14095d91fe9346cc81eb190N.exe 84 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 5116 wrote to memory of 2488 5116 76c9b3a4a14096d91fe9347cc91eb190N.exe 86 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 PID 2624 wrote to memory of 2212 2624 76c9b3a4a14096d91fe9347cc91eb190N.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\65c8b3a4a14095d91fe9346cc81eb190N.exe"C:\Users\Admin\AppData\Local\Temp\65c8b3a4a14095d91fe9346cc81eb190N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exeC:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2488
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exeC:\Users\Admin\AppData\Roaming\WinSocket\76c9b3a4a14096d91fe9347cc91eb190N.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD565c8b3a4a14095d91fe9346cc81eb190
SHA17b2ff61b779e7c3d1312d9edf23b79155697b701
SHA256680a36979824ada6163d67bbd22fc9dbb4b6a5a699e08cacec7cfaa7ecbc97d2
SHA5121cdf8c28e127dc29bf8353cc42d649ce55fbe4d6e6b7440891777821786d30cb01de26634e700ec6041857194a166166c1841e8cadcef3a204f9598afb69aafc