Analysis
-
max time kernel
138s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 04:57
Behavioral task
behavioral1
Sample
6becceb5454a3e9a9e3899a1978073b0_NEAS.exe
Resource
win7-20240221-en
General
-
Target
6becceb5454a3e9a9e3899a1978073b0_NEAS.exe
-
Size
1.1MB
-
MD5
6becceb5454a3e9a9e3899a1978073b0
-
SHA1
318033772e3907b155419e6fb8c199135f675341
-
SHA256
9e75579eda7e12897f9eb4e9bac58779a2d575d24d818c450fd0f024a29abb66
-
SHA512
a8d44cf353a5a865e096a9cc386b3cb848b49c97e2abaeb577ae677d8495debb14c7ef476028f9b845d365be4a448e6ec895802938ab4a325583d19b4e0ef9cf
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf69AsFV:E5aIwC+Agr6S/FEAGsji6A
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\7becceb6464a3e9a9e3999a1989083b0_NFAS.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/2532-15-0x0000000002FE0000-0x0000000003009000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
7becceb6464a3e9a9e3999a1989083b0_NFAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exepid process 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7becceb6464a3e9a9e3999a1989083b0_NFAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exedescription pid process Token: SeTcbPrivilege 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe Token: SeTcbPrivilege 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6becceb5454a3e9a9e3899a1978073b0_NEAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exepid process 2532 6becceb5454a3e9a9e3899a1978073b0_NEAS.exe 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6becceb5454a3e9a9e3899a1978073b0_NEAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exe7becceb6464a3e9a9e3999a1989083b0_NFAS.exedescription pid process target process PID 2532 wrote to memory of 4452 2532 6becceb5454a3e9a9e3899a1978073b0_NEAS.exe 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe PID 2532 wrote to memory of 4452 2532 6becceb5454a3e9a9e3899a1978073b0_NEAS.exe 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe PID 2532 wrote to memory of 4452 2532 6becceb5454a3e9a9e3899a1978073b0_NEAS.exe 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 4452 wrote to memory of 3752 4452 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 468 wrote to memory of 2240 468 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe PID 2880 wrote to memory of 4900 2880 7becceb6464a3e9a9e3999a1989083b0_NFAS.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6becceb5454a3e9a9e3899a1978073b0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\6becceb5454a3e9a9e3899a1978073b0_NEAS.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Roaming\WinSocket\7becceb6464a3e9a9e3999a1989083b0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\7becceb6464a3e9a9e3999a1989083b0_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3752
-
C:\Users\Admin\AppData\Roaming\WinSocket\7becceb6464a3e9a9e3999a1989083b0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\7becceb6464a3e9a9e3999a1989083b0_NFAS.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2240
-
C:\Users\Admin\AppData\Roaming\WinSocket\7becceb6464a3e9a9e3999a1989083b0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\7becceb6464a3e9a9e3999a1989083b0_NFAS.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD56becceb5454a3e9a9e3899a1978073b0
SHA1318033772e3907b155419e6fb8c199135f675341
SHA2569e75579eda7e12897f9eb4e9bac58779a2d575d24d818c450fd0f024a29abb66
SHA512a8d44cf353a5a865e096a9cc386b3cb848b49c97e2abaeb577ae677d8495debb14c7ef476028f9b845d365be4a448e6ec895802938ab4a325583d19b4e0ef9cf
-
Filesize
54KB
MD51e9b4638c283f403ab9881c5cab10694
SHA10e1a1ad3c58598daf2077fde6d3ed8c395ad4881
SHA2564832a54440e40a31cf80ce7cec273f9ab38d799e81696848702a5a520c999a5d
SHA51260002ac6196958bdcf5bca67cc01112e81692defb0708d5974ea4aa5d8f1cc232d8984028e74efc1310df251b649049871c4a78f97805fc0235db38f103880e6