Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2024 07:45
Static task
static1
Behavioral task
behavioral1
Sample
31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe
Resource
win7-20240708-en
General
-
Target
31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe
-
Size
690KB
-
MD5
79ae01e5eef805e95de9f8de445e0970
-
SHA1
d971be5391a387ef962644254cf64e25128285b2
-
SHA256
31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9
-
SHA512
a35b7cf3841355d3283bcea01c2d368d821992e807df1fd5179f576d1034b38d13345b1d917dda598255e38bb206ecbd7700ef11ba84b67039319d3e667aa7cf
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUt3r4DwpRrKO1YYVhiiSw9:zQ5aILMCfmAUhrSO1YNq9
Malware Config
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/3572-16-0x0000000002BC0000-0x0000000002BE9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3572 31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 3572 wrote to memory of 4600 3572 31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe 82 PID 3572 wrote to memory of 4600 3572 31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe 82 PID 3572 wrote to memory of 4600 3572 31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe 82 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4600 wrote to memory of 4836 4600 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 83 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 PID 4008 wrote to memory of 2024 4008 31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe"C:\Users\Admin\AppData\Local\Temp\31f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exeC:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4836
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exeC:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\31f92e938fe43d68f29ea1e338f6b2c8f6791aa4092e6c039783f39fe89d17b9N.exe
Filesize690KB
MD579ae01e5eef805e95de9f8de445e0970
SHA1d971be5391a387ef962644254cf64e25128285b2
SHA25631f92e937fe43d57f28ea1e337f5b2c7f5681aa4082e5c039673f39fe78d16b9
SHA512a35b7cf3841355d3283bcea01c2d368d821992e807df1fd5179f576d1034b38d13345b1d917dda598255e38bb206ecbd7700ef11ba84b67039319d3e667aa7cf