Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 11:25
Behavioral task
behavioral1
Sample
825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe
Resource
win7-20240221-en
General
-
Target
825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe
-
Size
1.1MB
-
MD5
825fd4e7bacce35f9d3999a4c28c3c40
-
SHA1
56c582db4d568babbb70a60de6e475a54db9a2b7
-
SHA256
21e516d51c181024b685554ae22760bc59d0485e8dffaaa99322597844bf000e
-
SHA512
42a2ac455c080452bea89c4fa4b40b382f47cfedef4200849987633bf5da9b1c206b778333c22834b05ecebb2001889e80166d62c3a84122481b335801ab4d89
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf69Aso:E5aIwC+Agr6S/FEAGsji6x
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1720-15-0x00000000026A0000-0x00000000026C9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exepid process 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe 644 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe 408 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe -
Loads dropped DLL 2 IoCs
Processes:
825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exepid process 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2612 sc.exe 2652 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exepowershell.exepid process 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 2732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exedescription pid process Token: SeDebugPrivilege 2732 powershell.exe Token: SeTcbPrivilege 644 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe Token: SeTcbPrivilege 408 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exepid process 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe 644 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe 408 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.execmd.execmd.execmd.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exetaskeng.exe926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exedescription pid process target process PID 1720 wrote to memory of 2104 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 2104 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 2104 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 2104 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 3024 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 3024 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 3024 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 3024 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 2648 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 2648 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 2648 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 1720 wrote to memory of 2648 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe cmd.exe PID 3024 wrote to memory of 2612 3024 cmd.exe sc.exe PID 3024 wrote to memory of 2612 3024 cmd.exe sc.exe PID 3024 wrote to memory of 2612 3024 cmd.exe sc.exe PID 3024 wrote to memory of 2612 3024 cmd.exe sc.exe PID 2104 wrote to memory of 2652 2104 cmd.exe sc.exe PID 2104 wrote to memory of 2652 2104 cmd.exe sc.exe PID 2104 wrote to memory of 2652 2104 cmd.exe sc.exe PID 2104 wrote to memory of 2652 2104 cmd.exe sc.exe PID 1720 wrote to memory of 2600 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 1720 wrote to memory of 2600 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 1720 wrote to memory of 2600 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 1720 wrote to memory of 2600 1720 825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 2648 wrote to memory of 2732 2648 cmd.exe powershell.exe PID 2648 wrote to memory of 2732 2648 cmd.exe powershell.exe PID 2648 wrote to memory of 2732 2648 cmd.exe powershell.exe PID 2648 wrote to memory of 2732 2648 cmd.exe powershell.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2600 wrote to memory of 2456 2600 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 2644 wrote to memory of 644 2644 taskeng.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 2644 wrote to memory of 644 2644 taskeng.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 2644 wrote to memory of 644 2644 taskeng.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 2644 wrote to memory of 644 2644 taskeng.exe 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe PID 644 wrote to memory of 1924 644 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 644 wrote to memory of 1924 644 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 644 wrote to memory of 1924 644 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe PID 644 wrote to memory of 1924 644 926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\825fd4e7bacce35f9d3999a4c28c3c40_NEIKI.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2652 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2612 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exeC:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2456
-
C:\Windows\system32\taskeng.exetaskeng.exe {F11D5BA7-2ED5-4E53-B9EE-6765F605985C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exeC:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1924
-
C:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exeC:\Users\Admin\AppData\Roaming\WinSocket\926fd4e8bacce36f9d3999a4c29c3c40_NFJLJ.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:408 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5825fd4e7bacce35f9d3999a4c28c3c40
SHA156c582db4d568babbb70a60de6e475a54db9a2b7
SHA25621e516d51c181024b685554ae22760bc59d0485e8dffaaa99322597844bf000e
SHA51242a2ac455c080452bea89c4fa4b40b382f47cfedef4200849987633bf5da9b1c206b778333c22834b05ecebb2001889e80166d62c3a84122481b335801ab4d89