Analysis

  • max time kernel
    136s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-05-2024 15:14

General

  • Target

    c6b1d13e1af4dbe86b0a8d57f28c5850_NEAS.exe

  • Size

    1.2MB

  • MD5

    c6b1d13e1af4dbe86b0a8d57f28c5850

  • SHA1

    6cd2a70a3d4d4a3ef9a3a1aaae5e04d2a0a85498

  • SHA256

    ae9be39abd3ca69556a88062e1269e84325e12503e0575348bb3fa905b52ccc1

  • SHA512

    c1d29410c2ba497ca38dc0bd8a06bf629d88899bff51d0190a110aaa235453924e7507892c4a4401d7559e2722551ee59d759220ba0812b2ef1f98ee2d34833e

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQE4efQg3zNn+2jsvercPk9N4hVI3/TQyFM:E5aIwC+Agr6SqCPGvTy

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6b1d13e1af4dbe86b0a8d57f28c5850_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\c6b1d13e1af4dbe86b0a8d57f28c5850_NEAS.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\SysWOW64\cmd.exe
      /c sc stop WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:2488
    • C:\Windows\SysWOW64\cmd.exe
      /c sc delete WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\SysWOW64\sc.exe
        sc delete WinDefend
        3⤵
        • Launches sc.exe
        PID:2644
    • C:\Windows\SysWOW64\cmd.exe
      /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2912
    • C:\Users\Admin\AppData\Roaming\WinSocket\c7b1d13e1af4dbe97b0a9d68f29c6960_NFAS.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\c7b1d13e1af4dbe97b0a9d68f29c6960_NFAS.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\SysWOW64\cmd.exe
        /c sc stop WinDefend
        3⤵
          PID:2528
          • C:\Windows\SysWOW64\sc.exe
            sc stop WinDefend
            4⤵
            • Launches sc.exe
            PID:328
        • C:\Windows\SysWOW64\cmd.exe
          /c sc delete WinDefend
          3⤵
            PID:2520
            • C:\Windows\SysWOW64\sc.exe
              sc delete WinDefend
              4⤵
              • Launches sc.exe
              PID:456
          • C:\Windows\SysWOW64\cmd.exe
            /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
            3⤵
              PID:2624
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableRealtimeMonitoring $true
                4⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1372
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              3⤵
                PID:2368
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {FA204B1E-6405-4A38-AC5E-40AB2BFDBB74} S-1-5-18:NT AUTHORITY\System:Service:
            1⤵
              PID:2948
              • C:\Users\Admin\AppData\Roaming\WinSocket\c7b1d13e1af4dbe97b0a9d68f29c6960_NFAS.exe
                C:\Users\Admin\AppData\Roaming\WinSocket\c7b1d13e1af4dbe97b0a9d68f29c6960_NFAS.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:2736
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  3⤵
                    PID:628
                • C:\Users\Admin\AppData\Roaming\WinSocket\c7b1d13e1af4dbe97b0a9d68f29c6960_NFAS.exe
                  C:\Users\Admin\AppData\Roaming\WinSocket\c7b1d13e1af4dbe97b0a9d68f29c6960_NFAS.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:1908
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe
                    3⤵
                      PID:1848

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZBJKG7JXLY9PF8ZZC021.temp

                  Filesize

                  7KB

                  MD5

                  96b78f147974bf1363eed7b08b71bb92

                  SHA1

                  2bbe6d4f09e11e39f613690f3a0f84079b98831f

                  SHA256

                  b7d0fcf65f95b06e61a6e7e3f340e40569547a6c2d11afff5a5738216e0239d6

                  SHA512

                  e661f247e794fa1100fbfe97f07856df1b9de24a48c449856b3a562d7ee30b366c9d35d971a8f312c733a73f5ffa65754e90346727511f358d6273b6616f6b60

                • C:\Users\Admin\AppData\Roaming\WinSocket\c7b1d13e1af4dbe97b0a9d68f29c6960_NFAS.exe

                  Filesize

                  1.2MB

                  MD5

                  c6b1d13e1af4dbe86b0a8d57f28c5850

                  SHA1

                  6cd2a70a3d4d4a3ef9a3a1aaae5e04d2a0a85498

                  SHA256

                  ae9be39abd3ca69556a88062e1269e84325e12503e0575348bb3fa905b52ccc1

                  SHA512

                  c1d29410c2ba497ca38dc0bd8a06bf629d88899bff51d0190a110aaa235453924e7507892c4a4401d7559e2722551ee59d759220ba0812b2ef1f98ee2d34833e

                • memory/2292-3-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-9-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-2-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-12-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-7-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-8-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-11-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-18-0x0000000000400000-0x0000000000472000-memory.dmp

                  Filesize

                  456KB

                • memory/2292-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-15-0x0000000000540000-0x0000000000569000-memory.dmp

                  Filesize

                  164KB

                • memory/2292-17-0x0000000000421000-0x0000000000422000-memory.dmp

                  Filesize

                  4KB

                • memory/2292-10-0x00000000002A0000-0x00000000002A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2368-49-0x0000000010000000-0x000000001001E000-memory.dmp

                  Filesize

                  120KB

                • memory/2368-50-0x0000000010000000-0x000000001001E000-memory.dmp

                  Filesize

                  120KB

                • memory/2676-35-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-36-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-33-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-34-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-44-0x0000000000400000-0x0000000000472000-memory.dmp

                  Filesize

                  456KB

                • memory/2676-46-0x0000000010000000-0x0000000010007000-memory.dmp

                  Filesize

                  28KB

                • memory/2676-31-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-32-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-37-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-38-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-39-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-40-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-41-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-30-0x00000000003D0000-0x00000000003D1000-memory.dmp

                  Filesize

                  4KB

                • memory/2676-45-0x0000000010000000-0x0000000010007000-memory.dmp

                  Filesize

                  28KB

                • memory/2736-67-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-76-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-75-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-74-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-73-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-72-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-71-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-70-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-69-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-68-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-77-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/2736-66-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB