Analysis

  • max time kernel
    135s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 19:21

General

  • Target

    01f8cd895dd719c83038356c6fe96160_NEAS.exe

  • Size

    1.2MB

  • MD5

    01f8cd895dd719c83038356c6fe96160

  • SHA1

    4b817e515df12017f6b1d3c5becb27934ab62fd7

  • SHA256

    efc7cfc7f83e9a33a7856e1108c2433887172153ea8fc56076534925a5d94d32

  • SHA512

    8ca9a0eb469c8e51eb03f4e6bae011a4b19d3831d9c77bf34b0929f91f52c4ed5cbba0b3ef9892364bc6c1ffa5f50a4f046c5814271ae5a0a1da393449e10c91

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51WnO7h:E5aIwC+Agr6StVEnmcKxY/O1R

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\01f8cd895dd719c83038356c6fe96160_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\01f8cd895dd719c83038356c6fe96160_NEAS.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Users\Admin\AppData\Roaming\WinSocket\01f9cd996dd819c93039367c7fe97170_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\01f9cd996dd819c93039367c7fe97170_NFAS.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1292
    • C:\Users\Admin\AppData\Roaming\WinSocket\01f9cd996dd819c93039367c7fe97170_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\01f9cd996dd819c93039367c7fe97170_NFAS.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:864
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:3280
      • C:\Users\Admin\AppData\Roaming\WinSocket\01f9cd996dd819c93039367c7fe97170_NFAS.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\01f9cd996dd819c93039367c7fe97170_NFAS.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:960
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:1040

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\01f9cd996dd819c93039367c7fe97170_NFAS.exe

          Filesize

          1.2MB

          MD5

          01f8cd895dd719c83038356c6fe96160

          SHA1

          4b817e515df12017f6b1d3c5becb27934ab62fd7

          SHA256

          efc7cfc7f83e9a33a7856e1108c2433887172153ea8fc56076534925a5d94d32

          SHA512

          8ca9a0eb469c8e51eb03f4e6bae011a4b19d3831d9c77bf34b0929f91f52c4ed5cbba0b3ef9892364bc6c1ffa5f50a4f046c5814271ae5a0a1da393449e10c91

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          10KB

          MD5

          3f181ab831151a23c457c05c19f29eb1

          SHA1

          d3b51b5de9e2975a4d28092c4abe562e788268d4

          SHA256

          593537e2663832050dcbbabea830c973e17bc36f4d86caee2ca5b19ca4927968

          SHA512

          793ede9be6ca78e1b605a3beb2e594a0c32c508b72decc902a2c08e38756fa7b3777b062ca41c4a274cc32efd2d7f56a07cf7cd822633bb9a4a7b41d901e2521

        • memory/864-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/864-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/864-58-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-59-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-60-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-61-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-62-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-63-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-64-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-65-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-66-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-67-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-68-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/864-69-0x0000000001600000-0x0000000001601000-memory.dmp

          Filesize

          4KB

        • memory/1120-32-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-26-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-37-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/1120-36-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-35-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-34-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-33-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-53-0x0000000003160000-0x0000000003429000-memory.dmp

          Filesize

          2.8MB

        • memory/1120-31-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-42-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/1120-41-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/1120-30-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-29-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-28-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-27-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/1120-52-0x0000000003060000-0x000000000311E000-memory.dmp

          Filesize

          760KB

        • memory/1292-51-0x000001AF267C0000-0x000001AF267C1000-memory.dmp

          Filesize

          4KB

        • memory/1292-46-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/3224-6-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-5-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/3224-15-0x0000000003120000-0x0000000003149000-memory.dmp

          Filesize

          164KB

        • memory/3224-7-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-4-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/3224-3-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-2-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-8-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-9-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-10-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-11-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-12-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-13-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB

        • memory/3224-14-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

          Filesize

          4KB