Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 05:56

General

  • Target

    79f18ca94d967d0816a7b0eceeaba8d0_NEAS.exe

  • Size

    1.2MB

  • MD5

    79f18ca94d967d0816a7b0eceeaba8d0

  • SHA1

    59bb1c66df86080789d466843ee379007c0e6b44

  • SHA256

    d025eca669224179172e4cebc5ccfb5c1803d596eb707f6d660f85d214d54b4a

  • SHA512

    97041c64ba1870dbb4f2250951b9a3b2a636fd7e015bfbd829f41d5ff1a08a9160db72d5f225eb56ead9895394c1adfc7faa7bb36c5f452d394fed5c4733ed34

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOFZ+jJ/1q0GrbcUxnMjb:E5aIwC+Agr6StVEnmcKWnq0vljb

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\79f18ca94d967d0816a7b0eceeaba8d0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\79f18ca94d967d0816a7b0eceeaba8d0_NEAS.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Roaming\WinSocket\89f19ca94d978d0917a8b0eceeaba9d0_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\89f19ca94d978d0917a8b0eceeaba9d0_NFAS.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3240
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2684
    • C:\Users\Admin\AppData\Roaming\WinSocket\89f19ca94d978d0917a8b0eceeaba9d0_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\89f19ca94d978d0917a8b0eceeaba9d0_NFAS.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
        • Modifies data under HKEY_USERS
        PID:4384
    • C:\Users\Admin\AppData\Roaming\WinSocket\89f19ca94d978d0917a8b0eceeaba9d0_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\89f19ca94d978d0917a8b0eceeaba9d0_NFAS.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:3552

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\WinSocket\89f19ca94d978d0917a8b0eceeaba9d0_NFAS.exe

        Filesize

        1.2MB

        MD5

        79f18ca94d967d0816a7b0eceeaba8d0

        SHA1

        59bb1c66df86080789d466843ee379007c0e6b44

        SHA256

        d025eca669224179172e4cebc5ccfb5c1803d596eb707f6d660f85d214d54b4a

        SHA512

        97041c64ba1870dbb4f2250951b9a3b2a636fd7e015bfbd829f41d5ff1a08a9160db72d5f225eb56ead9895394c1adfc7faa7bb36c5f452d394fed5c4733ed34

      • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

        Filesize

        19KB

        MD5

        2d58d5aff732463ef96847fd3411ba13

        SHA1

        df0edc9850b4f6678f7ad2c2a8644c67798b9306

        SHA256

        9f88b198ef9a913316abad3ce2567d8ccd23a9829e4e85df5c7abbd7a3b9c290

        SHA512

        cfc569d6d4e98295667c6b5c1b98be88702578e2929a94572f39602ed4e836426672acc81833ad9214eeb3192572ca9cc2c66fe481a87b37dd6a19a9068d3805

      • memory/1056-13-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-12-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-10-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-9-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-8-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-14-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-2-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-5-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-11-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-7-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-6-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-15-0x0000000003020000-0x0000000003049000-memory.dmp

        Filesize

        164KB

      • memory/1056-18-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/1056-17-0x0000000000421000-0x0000000000422000-memory.dmp

        Filesize

        4KB

      • memory/1056-4-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1056-3-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

      • memory/1984-67-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-63-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-73-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/1984-72-0x0000000000421000-0x0000000000422000-memory.dmp

        Filesize

        4KB

      • memory/1984-58-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-59-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-60-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-61-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-62-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-69-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-68-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-66-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-65-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/1984-64-0x0000000001600000-0x0000000001601000-memory.dmp

        Filesize

        4KB

      • memory/2684-46-0x0000000010000000-0x000000001001E000-memory.dmp

        Filesize

        120KB

      • memory/2684-52-0x0000029AADA50000-0x0000029AADA51000-memory.dmp

        Filesize

        4KB

      • memory/2684-47-0x0000000010000000-0x000000001001E000-memory.dmp

        Filesize

        120KB

      • memory/3240-41-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/3240-42-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/3240-26-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-27-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-35-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-28-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-29-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-51-0x0000000003060000-0x000000000311E000-memory.dmp

        Filesize

        760KB

      • memory/3240-34-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-53-0x0000000003160000-0x0000000003429000-memory.dmp

        Filesize

        2.8MB

      • memory/3240-40-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/3240-37-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-30-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-31-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-32-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-33-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB

      • memory/3240-36-0x00000000020B0000-0x00000000020B1000-memory.dmp

        Filesize

        4KB