Analysis
-
max time kernel
135s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 03:36
Behavioral task
behavioral1
Sample
5cfa4b705d88c768400fa4c88396f120_NEAS.exe
Resource
win7-20240221-en
General
-
Target
5cfa4b705d88c768400fa4c88396f120_NEAS.exe
-
Size
1.3MB
-
MD5
5cfa4b705d88c768400fa4c88396f120
-
SHA1
deff2c89ada55dd327743b92f3e764098f8d9dcb
-
SHA256
dbb838e53fb35c86e03a4d1e8fdf200ec6b4d102c7654f1c7dc9514ae61eacbe
-
SHA512
421b54eae382e5b9bff9e4bf32080ce1c8b006d09d5d9bea2842dea8f7bb99b13107a682c0cc38128c383e9cf5f4e36a3888f2a52dea89b6e50abb0e1796ae40
-
SSDEEP
24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQU:E5aIwC+Agr6twjVDF
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\6cfa4b806d99c879400fa4c99397f120_NFAS.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2512-15-0x0000000000700000-0x0000000000729000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
6cfa4b806d99c879400fa4c99397f120_NFAS.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exepid process 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe 3000 6cfa4b806d99c879400fa4c99397f120_NFAS.exe 412 6cfa4b806d99c879400fa4c99397f120_NFAS.exe -
Loads dropped DLL 2 IoCs
Processes:
5cfa4b705d88c768400fa4c88396f120_NEAS.exepid process 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2436 sc.exe 2864 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
5cfa4b705d88c768400fa4c88396f120_NEAS.exepowershell.exepid process 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 552 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exedescription pid process Token: SeDebugPrivilege 552 powershell.exe Token: SeTcbPrivilege 3000 6cfa4b806d99c879400fa4c99397f120_NFAS.exe Token: SeTcbPrivilege 412 6cfa4b806d99c879400fa4c99397f120_NFAS.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
5cfa4b705d88c768400fa4c88396f120_NEAS.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exepid process 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe 3000 6cfa4b806d99c879400fa4c99397f120_NFAS.exe 412 6cfa4b806d99c879400fa4c99397f120_NFAS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5cfa4b705d88c768400fa4c88396f120_NEAS.execmd.execmd.execmd.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exetaskeng.exe6cfa4b806d99c879400fa4c99397f120_NFAS.exedescription pid process target process PID 2512 wrote to memory of 1128 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 1128 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 1128 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 1128 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 1152 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 1152 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 1152 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 1152 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 2052 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 2052 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 2052 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 2052 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe cmd.exe PID 2512 wrote to memory of 2748 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 2512 wrote to memory of 2748 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 2512 wrote to memory of 2748 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 2512 wrote to memory of 2748 2512 5cfa4b705d88c768400fa4c88396f120_NEAS.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 1152 wrote to memory of 2436 1152 cmd.exe sc.exe PID 1152 wrote to memory of 2436 1152 cmd.exe sc.exe PID 1152 wrote to memory of 2436 1152 cmd.exe sc.exe PID 1152 wrote to memory of 2436 1152 cmd.exe sc.exe PID 2052 wrote to memory of 552 2052 cmd.exe powershell.exe PID 2052 wrote to memory of 552 2052 cmd.exe powershell.exe PID 2052 wrote to memory of 552 2052 cmd.exe powershell.exe PID 2052 wrote to memory of 552 2052 cmd.exe powershell.exe PID 1128 wrote to memory of 2864 1128 cmd.exe sc.exe PID 1128 wrote to memory of 2864 1128 cmd.exe sc.exe PID 1128 wrote to memory of 2864 1128 cmd.exe sc.exe PID 1128 wrote to memory of 2864 1128 cmd.exe sc.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2748 wrote to memory of 2736 2748 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 2676 wrote to memory of 3000 2676 taskeng.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 2676 wrote to memory of 3000 2676 taskeng.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 2676 wrote to memory of 3000 2676 taskeng.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 2676 wrote to memory of 3000 2676 taskeng.exe 6cfa4b806d99c879400fa4c99397f120_NFAS.exe PID 3000 wrote to memory of 2948 3000 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 3000 wrote to memory of 2948 3000 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 3000 wrote to memory of 2948 3000 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe PID 3000 wrote to memory of 2948 3000 6cfa4b806d99c879400fa4c99397f120_NFAS.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cfa4b705d88c768400fa4c88396f120_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\5cfa4b705d88c768400fa4c88396f120_NEAS.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2864 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2436 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552 -
C:\Users\Admin\AppData\Roaming\WinSocket\6cfa4b806d99c879400fa4c99397f120_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\6cfa4b806d99c879400fa4c99397f120_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2736
-
C:\Windows\system32\taskeng.exetaskeng.exe {F08C5FF3-25E3-4AB0-AC32-0BE811FBF038} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Roaming\WinSocket\6cfa4b806d99c879400fa4c99397f120_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\6cfa4b806d99c879400fa4c99397f120_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2948
-
C:\Users\Admin\AppData\Roaming\WinSocket\6cfa4b806d99c879400fa4c99397f120_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\6cfa4b806d99c879400fa4c99397f120_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:412 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD55cfa4b705d88c768400fa4c88396f120
SHA1deff2c89ada55dd327743b92f3e764098f8d9dcb
SHA256dbb838e53fb35c86e03a4d1e8fdf200ec6b4d102c7654f1c7dc9514ae61eacbe
SHA512421b54eae382e5b9bff9e4bf32080ce1c8b006d09d5d9bea2842dea8f7bb99b13107a682c0cc38128c383e9cf5f4e36a3888f2a52dea89b6e50abb0e1796ae40