Analysis
-
max time kernel
136s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 08:30
Behavioral task
behavioral1
Sample
2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe
Resource
win7-20240419-en
General
-
Target
2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe
-
Size
1.3MB
-
MD5
2bc2d4e2cf1706542b76460e36d968b0
-
SHA1
ecd2a5f2fc75165918dd3d6d4783e3dbeaae3da9
-
SHA256
fb5a0ecb62aa6fbf3ee2a2044860b7c30dc00654dd75da35e48c19de35313a76
-
SHA512
d90ad63051f8b2cd43362056d598a7d38795c5d67be4542808cb0413a52abd6a9f60920cc8839543021fe5a31437bd3f3d57ba2e960a846ce686582cc1993fb3
-
SSDEEP
24576:zQ5aILMCfmAUjzX6gfU1pjwjbsXhmvZssrD+nRgnf4NvlOSBRGh+i:E5aIwC+Agr6g81p1vsrNiK7
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4400-15-0x0000000002170000-0x0000000002199000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exepid process 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exedescription pid process Token: SeTcbPrivilege 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe Token: SeTcbPrivilege 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exepid process 4400 2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exedescription pid process target process PID 4400 wrote to memory of 4436 4400 2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe PID 4400 wrote to memory of 4436 4400 2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe PID 4400 wrote to memory of 4436 4400 2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 4436 wrote to memory of 4260 4436 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 2872 wrote to memory of 5084 2872 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe PID 3928 wrote to memory of 3604 3928 2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\2bc2d4e2cf1706542b76460e36d968b0_NEIKI.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Roaming\WinSocket\2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exeC:\Users\Admin\AppData\Roaming\WinSocket\2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4260
-
C:\Users\Admin\AppData\Roaming\WinSocket\2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exeC:\Users\Admin\AppData\Roaming\WinSocket\2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:5084
-
C:\Users\Admin\AppData\Roaming\WinSocket\2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exeC:\Users\Admin\AppData\Roaming\WinSocket\2bc2d4e2cf1807642b87470e37d979b0_NFJLJ.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:3604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD52bc2d4e2cf1706542b76460e36d968b0
SHA1ecd2a5f2fc75165918dd3d6d4783e3dbeaae3da9
SHA256fb5a0ecb62aa6fbf3ee2a2044860b7c30dc00654dd75da35e48c19de35313a76
SHA512d90ad63051f8b2cd43362056d598a7d38795c5d67be4542808cb0413a52abd6a9f60920cc8839543021fe5a31437bd3f3d57ba2e960a846ce686582cc1993fb3
-
Filesize
52KB
MD5ae2a904d34d66b6fc5703398f8c5ec3f
SHA16628c0e30f252d09a0e815c04992a05a9d468931
SHA256cac8d7facd329970422f9bdcfab213da626bfba706998794cb4c3171d98c1fae
SHA512f261519ac3a278c4c8082b8040b6961df2485a7f0d697cb2064a87b8962731236c00a706d9f6c10424e0932e37bb847bcd3019cda6ed903ff0ac01dc48b50668