Analysis
-
max time kernel
135s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 11:50
Behavioral task
behavioral1
Sample
63dd50459022417355a344051addbb40_NEAS.exe
Resource
win7-20240215-en
General
-
Target
63dd50459022417355a344051addbb40_NEAS.exe
-
Size
926KB
-
MD5
63dd50459022417355a344051addbb40
-
SHA1
0c63375768c07404e70aa5af77061d6cc2f4b901
-
SHA256
b9099e6b5cb7a631aef9551575a83e5f5b7bf5121bdd76ee7f96c50155e63753
-
SHA512
135710986db626bdf75834ff9779d130d59f63d5afb6df7e45addc6d321154a57176d8a526ff314779c531660e556ab1de50c943392689a7a66943267cf92c08
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSsGa60C+4PMAQNhW4L+OR9a:zQ5aILMCfmAUjzX6xQtjmsNLRu
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\73dd60469022418366a344061addbb40_NFAS.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1656-15-0x0000000000500000-0x0000000000529000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
73dd60469022418366a344061addbb40_NFAS.exe73dd60469022418366a344061addbb40_NFAS.exe73dd60469022418366a344061addbb40_NFAS.exepid process 2476 73dd60469022418366a344061addbb40_NFAS.exe 740 73dd60469022418366a344061addbb40_NFAS.exe 2976 73dd60469022418366a344061addbb40_NFAS.exe -
Loads dropped DLL 2 IoCs
Processes:
63dd50459022417355a344051addbb40_NEAS.exepid process 1656 63dd50459022417355a344051addbb40_NEAS.exe 1656 63dd50459022417355a344051addbb40_NEAS.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2520 sc.exe 1224 sc.exe 624 sc.exe 2380 sc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
63dd50459022417355a344051addbb40_NEAS.exe73dd60469022418366a344061addbb40_NFAS.exepowershell.exepowershell.exepid process 1656 63dd50459022417355a344051addbb40_NEAS.exe 1656 63dd50459022417355a344051addbb40_NEAS.exe 1656 63dd50459022417355a344051addbb40_NEAS.exe 2476 73dd60469022418366a344061addbb40_NFAS.exe 2476 73dd60469022418366a344061addbb40_NFAS.exe 2476 73dd60469022418366a344061addbb40_NFAS.exe 2524 powershell.exe 880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exe73dd60469022418366a344061addbb40_NFAS.exe73dd60469022418366a344061addbb40_NFAS.exedescription pid process Token: SeDebugPrivilege 880 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeTcbPrivilege 740 73dd60469022418366a344061addbb40_NFAS.exe Token: SeTcbPrivilege 2976 73dd60469022418366a344061addbb40_NFAS.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
63dd50459022417355a344051addbb40_NEAS.exe73dd60469022418366a344061addbb40_NFAS.exe73dd60469022418366a344061addbb40_NFAS.exe73dd60469022418366a344061addbb40_NFAS.exepid process 1656 63dd50459022417355a344051addbb40_NEAS.exe 2476 73dd60469022418366a344061addbb40_NFAS.exe 740 73dd60469022418366a344061addbb40_NFAS.exe 2976 73dd60469022418366a344061addbb40_NFAS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
63dd50459022417355a344051addbb40_NEAS.execmd.execmd.exe73dd60469022418366a344061addbb40_NFAS.execmd.exedescription pid process target process PID 1656 wrote to memory of 2900 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2900 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2900 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2900 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2496 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2496 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2496 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2496 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2460 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2460 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2460 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2460 1656 63dd50459022417355a344051addbb40_NEAS.exe cmd.exe PID 1656 wrote to memory of 2476 1656 63dd50459022417355a344051addbb40_NEAS.exe 73dd60469022418366a344061addbb40_NFAS.exe PID 1656 wrote to memory of 2476 1656 63dd50459022417355a344051addbb40_NEAS.exe 73dd60469022418366a344061addbb40_NFAS.exe PID 1656 wrote to memory of 2476 1656 63dd50459022417355a344051addbb40_NEAS.exe 73dd60469022418366a344061addbb40_NFAS.exe PID 1656 wrote to memory of 2476 1656 63dd50459022417355a344051addbb40_NEAS.exe 73dd60469022418366a344061addbb40_NFAS.exe PID 2460 wrote to memory of 2524 2460 cmd.exe powershell.exe PID 2460 wrote to memory of 2524 2460 cmd.exe powershell.exe PID 2460 wrote to memory of 2524 2460 cmd.exe powershell.exe PID 2460 wrote to memory of 2524 2460 cmd.exe powershell.exe PID 2900 wrote to memory of 2380 2900 cmd.exe sc.exe PID 2900 wrote to memory of 2380 2900 cmd.exe sc.exe PID 2900 wrote to memory of 2380 2900 cmd.exe sc.exe PID 2900 wrote to memory of 2380 2900 cmd.exe sc.exe PID 2476 wrote to memory of 2464 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2464 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2464 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2464 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2496 wrote to memory of 2520 2496 cmd.exe sc.exe PID 2496 wrote to memory of 2520 2496 cmd.exe sc.exe PID 2496 wrote to memory of 2520 2496 cmd.exe sc.exe PID 2496 wrote to memory of 2520 2496 cmd.exe sc.exe PID 2476 wrote to memory of 2568 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2568 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2568 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2568 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2364 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2364 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2364 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2364 2476 73dd60469022418366a344061addbb40_NFAS.exe cmd.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe PID 2476 wrote to memory of 2396 2476 73dd60469022418366a344061addbb40_NFAS.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\63dd50459022417355a344051addbb40_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\63dd50459022417355a344051addbb40_NEAS.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2380 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2520 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Users\Admin\AppData\Roaming\WinSocket\73dd60469022418366a344061addbb40_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\73dd60469022418366a344061addbb40_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵PID:2464
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
PID:624 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵PID:2568
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
PID:1224 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵PID:2364
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2396
-
C:\Windows\system32\taskeng.exetaskeng.exe {8435AB93-7B76-4772-988A-E8D38838613D} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1980
-
C:\Users\Admin\AppData\Roaming\WinSocket\73dd60469022418366a344061addbb40_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\73dd60469022418366a344061addbb40_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:740 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1104
-
C:\Users\Admin\AppData\Roaming\WinSocket\73dd60469022418366a344061addbb40_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\73dd60469022418366a344061addbb40_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2976 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5cce412655254191d37e7309ea86094ec
SHA15c98217c49fd77ed19f0294aaf68184b1f117e8e
SHA256ddb2018d867ddac6f812e9ef885c4a794ec9d67cd016310cf6926655482b9fd8
SHA51257264a84f99cbd26948e3ab73c1ba3bf4b71879b6d650d3205158a55153eda2daa60ab6c45e52f8171a5bbd52981aae9a78225f147cb3769de085c21b9ef40be
-
Filesize
926KB
MD563dd50459022417355a344051addbb40
SHA10c63375768c07404e70aa5af77061d6cc2f4b901
SHA256b9099e6b5cb7a631aef9551575a83e5f5b7bf5121bdd76ee7f96c50155e63753
SHA512135710986db626bdf75834ff9779d130d59f63d5afb6df7e45addc6d321154a57176d8a526ff314779c531660e556ab1de50c943392689a7a66943267cf92c08