Analysis
-
max time kernel
135s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 17:14
Behavioral task
behavioral1
Sample
e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe
Resource
win7-20240419-en
General
-
Target
e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe
-
Size
931KB
-
MD5
e9181259ebe70547cda0fb5cbee9d3c0
-
SHA1
665918652df82d7508bdb84975c46678c86aad9c
-
SHA256
b0947a84762157bd5413e4f46c30f736672cc28a59720cb8bb2e6aa4dbf45726
-
SHA512
f06bdf9a3c340c4a78c2be4df696aef59b14d56c1d05c04a9ddbe1b2f6cb7d0a44087024701303b8abcf43234f0c10731f5389afedcdffbbcbb63b056f1375a4
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSsGa60C+4PMAQNhW4Lq90jg:zQ5aILMCfmAUjzX6xQtjmsNLU3
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2188-15-0x0000000000490000-0x00000000004B9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exepid process 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe 3008 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe 2964 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe -
Loads dropped DLL 2 IoCs
Processes:
e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exepid process 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2516 sc.exe 2504 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exepowershell.exepid process 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe 2736 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exedescription pid process Token: SeDebugPrivilege 2736 powershell.exe Token: SeTcbPrivilege 3008 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe Token: SeTcbPrivilege 2964 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exepid process 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe 3008 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe 2964 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e9181259ebe70547cda0fb5cbee9d3c0_NEAS.execmd.execmd.execmd.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exetaskeng.exee9191269ebe80648cda0fb6cbee9d3c0_NFAS.exedescription pid process target process PID 2188 wrote to memory of 2272 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2272 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2272 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2272 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2096 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2096 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2096 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2096 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2572 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2572 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2572 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2572 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe cmd.exe PID 2188 wrote to memory of 2352 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 2188 wrote to memory of 2352 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 2188 wrote to memory of 2352 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 2188 wrote to memory of 2352 2188 e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 2096 wrote to memory of 2516 2096 cmd.exe sc.exe PID 2096 wrote to memory of 2516 2096 cmd.exe sc.exe PID 2096 wrote to memory of 2516 2096 cmd.exe sc.exe PID 2096 wrote to memory of 2516 2096 cmd.exe sc.exe PID 2572 wrote to memory of 2736 2572 cmd.exe powershell.exe PID 2572 wrote to memory of 2736 2572 cmd.exe powershell.exe PID 2572 wrote to memory of 2736 2572 cmd.exe powershell.exe PID 2572 wrote to memory of 2736 2572 cmd.exe powershell.exe PID 2272 wrote to memory of 2504 2272 cmd.exe sc.exe PID 2272 wrote to memory of 2504 2272 cmd.exe sc.exe PID 2272 wrote to memory of 2504 2272 cmd.exe sc.exe PID 2272 wrote to memory of 2504 2272 cmd.exe sc.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 2352 wrote to memory of 2536 2352 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 1624 wrote to memory of 3008 1624 taskeng.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 1624 wrote to memory of 3008 1624 taskeng.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 1624 wrote to memory of 3008 1624 taskeng.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 1624 wrote to memory of 3008 1624 taskeng.exe e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe PID 3008 wrote to memory of 2576 3008 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 3008 wrote to memory of 2576 3008 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 3008 wrote to memory of 2576 3008 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe PID 3008 wrote to memory of 2576 3008 e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\e9181259ebe70547cda0fb5cbee9d3c0_NEAS.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2504 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2516 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Users\Admin\AppData\Roaming\WinSocket\e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2536
-
C:\Windows\system32\taskeng.exetaskeng.exe {D0C85FF3-1EE9-403F-A36E-D0E74ED4F725} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Roaming\WinSocket\e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2576
-
C:\Users\Admin\AppData\Roaming\WinSocket\e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exeC:\Users\Admin\AppData\Roaming\WinSocket\e9191269ebe80648cda0fb6cbee9d3c0_NFAS.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2964 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
931KB
MD5e9181259ebe70547cda0fb5cbee9d3c0
SHA1665918652df82d7508bdb84975c46678c86aad9c
SHA256b0947a84762157bd5413e4f46c30f736672cc28a59720cb8bb2e6aa4dbf45726
SHA512f06bdf9a3c340c4a78c2be4df696aef59b14d56c1d05c04a9ddbe1b2f6cb7d0a44087024701303b8abcf43234f0c10731f5389afedcdffbbcbb63b056f1375a4