Analysis

  • max time kernel
    136s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 05:10

General

  • Target

    6e4ecf2453ea828d39e23b73e4b23260_NEAS.exe

  • Size

    1.3MB

  • MD5

    6e4ecf2453ea828d39e23b73e4b23260

  • SHA1

    51caee4b0eea1d7ac785095302b2b9c111eb3833

  • SHA256

    dbeb39cf194a8bde6d14d80f8db5adc5188472f747e2389807b58377e9d4acbf

  • SHA512

    ffcb0d8266d544bafadd4a52b037e6825c0696237249be6bb6a4818be3c0568014143e14720f6b9cbb83897735c2a9b38285207b8c848f212ad7bd106ad0ae25

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sdr36OTcgapChIz:E5aIwC+Agr6S/FEVM

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e4ecf2453ea828d39e23b73e4b23260_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\6e4ecf2453ea828d39e23b73e4b23260_NEAS.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Users\Admin\AppData\Roaming\WinSocket\7e4ecf2463ea929d39e23b83e4b23270_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\7e4ecf2463ea929d39e23b83e4b23270_NFAS.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2160
    • C:\Users\Admin\AppData\Roaming\WinSocket\7e4ecf2463ea929d39e23b83e4b23270_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\7e4ecf2463ea929d39e23b83e4b23270_NFAS.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:1320
      • C:\Users\Admin\AppData\Roaming\WinSocket\7e4ecf2463ea929d39e23b83e4b23270_NFAS.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\7e4ecf2463ea929d39e23b83e4b23270_NFAS.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:4792

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\7e4ecf2463ea929d39e23b83e4b23270_NFAS.exe

          Filesize

          1.3MB

          MD5

          6e4ecf2453ea828d39e23b73e4b23260

          SHA1

          51caee4b0eea1d7ac785095302b2b9c111eb3833

          SHA256

          dbeb39cf194a8bde6d14d80f8db5adc5188472f747e2389807b58377e9d4acbf

          SHA512

          ffcb0d8266d544bafadd4a52b037e6825c0696237249be6bb6a4818be3c0568014143e14720f6b9cbb83897735c2a9b38285207b8c848f212ad7bd106ad0ae25

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          78KB

          MD5

          ee3c80d89459eb45321714f674724c5d

          SHA1

          60392a350f79e59b553623ccb5327fdb71c393fc

          SHA256

          2febed9e7a6113a676fbc4bca860dd2db945b5306425d988b36966cd030a0a27

          SHA512

          3e7e715a7a09c54c4477d285817e98d8e244c4b0e5a2b95474744ce2b8d67c9a5ff0e3726c4183ba2e0110363dc538c6792e5737a1fed0ea11f99288046a7400

        • memory/2160-47-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/2160-51-0x000002562E200000-0x000002562E201000-memory.dmp

          Filesize

          4KB

        • memory/2160-46-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/4272-29-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-31-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-26-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-27-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-28-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-35-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-30-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-52-0x0000000003060000-0x000000000311E000-memory.dmp

          Filesize

          760KB

        • memory/4272-32-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-33-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-34-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-53-0x0000000003160000-0x0000000003429000-memory.dmp

          Filesize

          2.8MB

        • memory/4272-37-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4272-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4272-41-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/4272-36-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4600-69-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-68-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4600-58-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-59-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-60-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-61-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-62-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/4600-63-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-64-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-65-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-66-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4600-67-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

          Filesize

          4KB

        • memory/4720-11-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-6-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-9-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-8-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/4720-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-14-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-12-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/4720-15-0x0000000002200000-0x0000000002229000-memory.dmp

          Filesize

          164KB

        • memory/4720-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4720-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB