Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 23:09

General

  • Target

    2d6b22ddd824668bf44557810eee2ef0_NEAS.exe

  • Size

    1.2MB

  • MD5

    2d6b22ddd824668bf44557810eee2ef0

  • SHA1

    554588aa2bb768ceaa722fc121f7a06369ff10d4

  • SHA256

    40789cd8a229a28e6630a9175fee3054e35d403655acffd2c78a1551f0710ce7

  • SHA512

    5ba5f31fa6eed59afacfb143a4ed23d5d32aa25f3b74bb42b735e6e82b370168a60855ce45e9c01c27908a89885c35f67d1625d8fb6fc6e1f141feef164644af

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sdr36OTcgapChIwT:E5aIwC+Agr6S/FEVB

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d6b22ddd824668bf44557810eee2ef0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\2d6b22ddd824668bf44557810eee2ef0_NEAS.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Roaming\WinSocket\2d7b22ddd924779bf44668910eee2ef0_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\2d7b22ddd924779bf44668910eee2ef0_NFAS.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:3280
    • C:\Users\Admin\AppData\Roaming\WinSocket\2d7b22ddd924779bf44668910eee2ef0_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\2d7b22ddd924779bf44668910eee2ef0_NFAS.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:392
      • C:\Users\Admin\AppData\Roaming\WinSocket\2d7b22ddd924779bf44668910eee2ef0_NFAS.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\2d7b22ddd924779bf44668910eee2ef0_NFAS.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:3804

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\2d7b22ddd924779bf44668910eee2ef0_NFAS.exe

          Filesize

          1.2MB

          MD5

          2d6b22ddd824668bf44557810eee2ef0

          SHA1

          554588aa2bb768ceaa722fc121f7a06369ff10d4

          SHA256

          40789cd8a229a28e6630a9175fee3054e35d403655acffd2c78a1551f0710ce7

          SHA512

          5ba5f31fa6eed59afacfb143a4ed23d5d32aa25f3b74bb42b735e6e82b370168a60855ce45e9c01c27908a89885c35f67d1625d8fb6fc6e1f141feef164644af

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          25KB

          MD5

          04644379ce0dc6b4d3a3d560c1d5d8ee

          SHA1

          4f7865352ce4e1fa26f66a2bff8cf7bba382712b

          SHA256

          55efc84708d57bf0f52e9a46c7c6903ad669628ca60c277c1be28cd7a23be6aa

          SHA512

          ea5541aa297568d077a33b8b371bd7ef5d21efddf497b0bee2f37bbe214c676d5494ceab99eac045e81d999c988f1f61e342e4c31a2edb90eb4cf1b9e506d2a9

        • memory/2044-62-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-58-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/2044-59-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-60-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-61-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/2044-63-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-64-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-65-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-66-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-67-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-68-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/2044-69-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

          Filesize

          4KB

        • memory/3024-35-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-26-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-34-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-29-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-28-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-27-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-33-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/3024-53-0x0000000003180000-0x0000000003449000-memory.dmp

          Filesize

          2.8MB

        • memory/3024-30-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-32-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-52-0x0000000003080000-0x000000000313E000-memory.dmp

          Filesize

          760KB

        • memory/3024-42-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/3024-41-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/3024-37-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-36-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3024-31-0x00000000021B0000-0x00000000021B1000-memory.dmp

          Filesize

          4KB

        • memory/3280-47-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/3280-51-0x00000179A5A70000-0x00000179A5A71000-memory.dmp

          Filesize

          4KB

        • memory/3280-46-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/4764-6-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-7-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4764-15-0x0000000002280000-0x00000000022A9000-memory.dmp

          Filesize

          164KB

        • memory/4764-4-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-5-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-2-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/4764-8-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-9-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-10-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-11-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-12-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-3-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-13-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/4764-14-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB