Analysis

  • max time kernel
    138s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 02:46

General

  • Target

    53b4a3693af598e83e40f1fac14d8950_NEAS.exe

  • Size

    1013KB

  • MD5

    53b4a3693af598e83e40f1fac14d8950

  • SHA1

    01574d9f3e3d3e602821c9cc1432b3b0752ee06c

  • SHA256

    5e7c6d245a3a0c41f759b46bafbc5cf6ade0744cfc2c4299d3fe0d18201b5f04

  • SHA512

    f4843a4e6ec6a6b9bd405d27575e9a47ee3ed3beab5cbfc6e7740a7ed90431da7e10876170ae74243b266d8b0e95000962178d6ff61a6d8237f3d4d9513fc81c

  • SSDEEP

    12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEs1HzCHT4TlM9YmJ2Q97v54yRnkQgVf56:zQ5aILMCfmAUjzX6T0TlOnvPyQCf56

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\53b4a3693af598e83e40f1fac14d8950_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\53b4a3693af598e83e40f1fac14d8950_NEAS.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\AppData\Roaming\WinSocket\63b4a3793af699e93e40f1fac14d9960_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\63b4a3793af699e93e40f1fac14d9960_NFAS.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1744
    • C:\Users\Admin\AppData\Roaming\WinSocket\63b4a3793af699e93e40f1fac14d9960_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\63b4a3793af699e93e40f1fac14d9960_NFAS.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:3384
      • C:\Users\Admin\AppData\Roaming\WinSocket\63b4a3793af699e93e40f1fac14d9960_NFAS.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\63b4a3793af699e93e40f1fac14d9960_NFAS.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:2372

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\63b4a3793af699e93e40f1fac14d9960_NFAS.exe

          Filesize

          1013KB

          MD5

          53b4a3693af598e83e40f1fac14d8950

          SHA1

          01574d9f3e3d3e602821c9cc1432b3b0752ee06c

          SHA256

          5e7c6d245a3a0c41f759b46bafbc5cf6ade0744cfc2c4299d3fe0d18201b5f04

          SHA512

          f4843a4e6ec6a6b9bd405d27575e9a47ee3ed3beab5cbfc6e7740a7ed90431da7e10876170ae74243b266d8b0e95000962178d6ff61a6d8237f3d4d9513fc81c

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          50KB

          MD5

          07ab953bcc448636f31d6a20f752547b

          SHA1

          f85381e3f80dd91c66565025f0bb2f65fb010b4e

          SHA256

          2de7f0fe5100f4e95d5fe92183c9736a39665cc6ee59634b631f36cf12048df9

          SHA512

          e601725a1a31e6daedd8cfc5b8e43cf5f8e3447b99da8755bf13c8f97942b28e419cdc8aef56690ad1b88d2f14870342bc454385f91dc98db9a95be8d0c08fba

        • memory/1744-51-0x000002B4B44D0000-0x000002B4B44D1000-memory.dmp

          Filesize

          4KB

        • memory/1744-47-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/1744-46-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/2660-69-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-63-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-67-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-65-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-68-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-66-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-59-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-62-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-60-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-58-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-61-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          Filesize

          4KB

        • memory/2660-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/2660-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/3480-5-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-6-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-2-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-15-0x0000000002160000-0x0000000002189000-memory.dmp

          Filesize

          164KB

        • memory/3480-13-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/3480-12-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/3480-11-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-10-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-9-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-8-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-4-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-14-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/3480-7-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/4680-27-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4680-52-0x0000000003060000-0x000000000311E000-memory.dmp

          Filesize

          760KB

        • memory/4680-37-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-36-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-35-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-41-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/4680-53-0x0000000003160000-0x0000000003429000-memory.dmp

          Filesize

          2.8MB

        • memory/4680-26-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-34-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-28-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-29-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-30-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-31-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-32-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4680-33-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB