Analysis
-
max time kernel
136s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 01:18
Behavioral task
behavioral1
Sample
44a71764cdc5e937e3d65409bdd318a0_NEAS.exe
Resource
win7-20240419-en
General
-
Target
44a71764cdc5e937e3d65409bdd318a0_NEAS.exe
-
Size
1022KB
-
MD5
44a71764cdc5e937e3d65409bdd318a0
-
SHA1
f1405280b3c81d9f2c5ff6dfaafbde8440b757e0
-
SHA256
e1e9e74aecda0a4289de833724a957cc19ae6c6ffcf5a548491991de36aa2b6c
-
SHA512
834c2323d2dd4cca77d00cad928a38230afc82b44204de0f87ba4fc6cdd491d9f1f23bc4699a741f0017041fa5396b4d74e64e20e2f20b93394de5c541164323
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEs1HzCHT4TlM9YmJ2Q97v54yRnkQgVfIX3w:zQ5aILMCfmAUjzX6T0TlOnvPyQCfgA
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4708-15-0x0000000002190000-0x00000000021B9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
44a81874cdc6e938e3d76409bdd319a0_NFAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exepid process 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2464 4292 WerFault.exe 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
44a81874cdc6e938e3d76409bdd319a0_NFAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exedescription pid process Token: SeTcbPrivilege 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe Token: SeTcbPrivilege 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
44a71764cdc5e937e3d65409bdd318a0_NEAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exepid process 4708 44a71764cdc5e937e3d65409bdd318a0_NEAS.exe 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44a71764cdc5e937e3d65409bdd318a0_NEAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exe44a81874cdc6e938e3d76409bdd319a0_NFAS.exedescription pid process target process PID 4708 wrote to memory of 4804 4708 44a71764cdc5e937e3d65409bdd318a0_NEAS.exe 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe PID 4708 wrote to memory of 4804 4708 44a71764cdc5e937e3d65409bdd318a0_NEAS.exe 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe PID 4708 wrote to memory of 4804 4708 44a71764cdc5e937e3d65409bdd318a0_NEAS.exe 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4804 wrote to memory of 4752 4804 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 4292 wrote to memory of 3708 4292 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe PID 3460 wrote to memory of 2708 3460 44a81874cdc6e938e3d76409bdd319a0_NFAS.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\44a71764cdc5e937e3d65409bdd318a0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\44a71764cdc5e937e3d65409bdd318a0_NEAS.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4752
-
C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:3708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 7122⤵
- Program crash
PID:2464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4292 -ip 42921⤵PID:4868
-
C:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\44a81874cdc6e938e3d76409bdd319a0_NFAS.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1022KB
MD544a71764cdc5e937e3d65409bdd318a0
SHA1f1405280b3c81d9f2c5ff6dfaafbde8440b757e0
SHA256e1e9e74aecda0a4289de833724a957cc19ae6c6ffcf5a548491991de36aa2b6c
SHA512834c2323d2dd4cca77d00cad928a38230afc82b44204de0f87ba4fc6cdd491d9f1f23bc4699a741f0017041fa5396b4d74e64e20e2f20b93394de5c541164323
-
Filesize
33KB
MD5568a4d73fd73e360ee8e18b52a7f2c7f
SHA1ec7ef2e4e89acee15b95e63d91584e46c66c11d3
SHA2560bae05a24f36abf2291a24832f08c74cd2aea2dd2975e4b1aa8195bb09db2032
SHA512f1f27a375bb1e6b640c6d470924d9e8ea0b7a5532e94fbb19923742f9cfdbcff79c2f9799428c9977da0d75ee4b2dda4e19a0566d344c461132cae89702ad64a