Analysis

  • max time kernel
    138s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 09:11

General

  • Target

    3e31e01cdd290955878f90964f7f0f90_NEIKI.exe

  • Size

    1.2MB

  • MD5

    3e31e01cdd290955878f90964f7f0f90

  • SHA1

    8acab48cbe67a9a2c45e5d72a97fbb48c6ea4363

  • SHA256

    5a2cc88fa36f304586f3f6e81dba9beb0a9f5550fa8cb251a7d0bda34daeb72d

  • SHA512

    a9f3f0b325ead4f6e0b79183a55ddc6917c8295d9e4e5f2ee97f80a887c62ffe5f3a771b2a00b176645119242f816dd8365e664a53efe4fd1f95ee29e1a511f0

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6gfU1pjwjbsXhmvZssrD+nRgnf4NvlOSJ:E5aIwC+Agr6g81p1vsrNiJ

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e31e01cdd290955878f90964f7f0f90_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\3e31e01cdd290955878f90964f7f0f90_NEIKI.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Users\Admin\AppData\Roaming\WinSocket\3e31e01cdd290966989f90974f8f0f90_NFJLJ.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\3e31e01cdd290966989f90974f8f0f90_NFJLJ.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2376
    • C:\Users\Admin\AppData\Roaming\WinSocket\3e31e01cdd290966989f90974f8f0f90_NFJLJ.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\3e31e01cdd290966989f90974f8f0f90_NFJLJ.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:4408
      • C:\Users\Admin\AppData\Roaming\WinSocket\3e31e01cdd290966989f90974f8f0f90_NFJLJ.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\3e31e01cdd290966989f90974f8f0f90_NFJLJ.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4200
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:1404

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\3e31e01cdd290966989f90974f8f0f90_NFJLJ.exe

          Filesize

          1.2MB

          MD5

          3e31e01cdd290955878f90964f7f0f90

          SHA1

          8acab48cbe67a9a2c45e5d72a97fbb48c6ea4363

          SHA256

          5a2cc88fa36f304586f3f6e81dba9beb0a9f5550fa8cb251a7d0bda34daeb72d

          SHA512

          a9f3f0b325ead4f6e0b79183a55ddc6917c8295d9e4e5f2ee97f80a887c62ffe5f3a771b2a00b176645119242f816dd8365e664a53efe4fd1f95ee29e1a511f0

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          43KB

          MD5

          0590b59c79990f0d4e983fa970ccb739

          SHA1

          01ae2bec4a0e459e3bd3bcc8be38291a9e221eae

          SHA256

          f68899ec0e8e37601725b3cfd756e1386c7a92f9f730f09424b41e8138339e22

          SHA512

          19d6666b70e5e58da059d461185768be40f5c4199225f25764ce1958e4f8e7cd43f17dc64ef045075cf32b4b24444c1bc437e11fa3c1510cbb87be007331df19

        • memory/2244-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/2244-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/2244-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2244-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

          Filesize

          4KB

        • memory/2376-46-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/2376-53-0x0000014641850000-0x0000014641851000-memory.dmp

          Filesize

          4KB

        • memory/2376-47-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB

        • memory/4156-15-0x0000000002170000-0x0000000002199000-memory.dmp

          Filesize

          164KB

        • memory/4156-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4156-5-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-6-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-4-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-2-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-9-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-14-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-8-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-13-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-12-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-11-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-10-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-7-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-3-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/4156-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/4880-27-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-34-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-52-0x0000000003160000-0x0000000003429000-memory.dmp

          Filesize

          2.8MB

        • memory/4880-51-0x0000000003060000-0x000000000311E000-memory.dmp

          Filesize

          760KB

        • memory/4880-36-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-35-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-42-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/4880-41-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/4880-26-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-37-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-28-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-29-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/4880-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-32-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB

        • memory/4880-33-0x00000000021D0000-0x00000000021D1000-memory.dmp

          Filesize

          4KB