Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 12:13

General

  • Target

    e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe

  • Size

    1.2MB

  • MD5

    e1caefc11f36048b4d3998e26c0c8140

  • SHA1

    80d82492c25fe821f589d211d324bf05d18b399d

  • SHA256

    25a424ecc5f426c420bce4c5ae1814bc5b705d2e1d453c25b8d4631ea5608a6d

  • SHA512

    30dd8ad9bf4b8f6af32dfcace79dbe1f2eddd62c908cdc4f6d5baca419ccfb529d7857063d5a00addc5fae999b3bf5e262a52d01afdbb1523c87d918fc657ff3

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51Wn+q:E5aIwC+Agr6StVEnmcKxY/O1pq

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:3940
    • C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:1168
      • C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2440
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:3756

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe

          Filesize

          1.2MB

          MD5

          e1caefc11f36048b4d3998e26c0c8140

          SHA1

          80d82492c25fe821f589d211d324bf05d18b399d

          SHA256

          25a424ecc5f426c420bce4c5ae1814bc5b705d2e1d453c25b8d4631ea5608a6d

          SHA512

          30dd8ad9bf4b8f6af32dfcace79dbe1f2eddd62c908cdc4f6d5baca419ccfb529d7857063d5a00addc5fae999b3bf5e262a52d01afdbb1523c87d918fc657ff3

        • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

          Filesize

          21KB

          MD5

          622f83f4b90148ce93d402e8ca0f7e7f

          SHA1

          7c142b16f31296b83b42af19be2dca6b6d894b7a

          SHA256

          17d0bc2d8c993269b7ca43bde6715c44a82d65b0bc79ed87f952cd3151a49148

          SHA512

          28edccff1c0b490197ab2f6545ed56abef5d96973d351201c18543e03419aa9d930521b2f5fea2dfacafdbe6473bbae7810bb0d0c6ffc0738f1983e4fdefa575

        • memory/1056-73-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/1056-72-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/1056-58-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-59-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-60-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-61-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-62-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-63-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-64-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-65-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-66-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-67-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-68-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1056-69-0x0000000000750000-0x0000000000751000-memory.dmp

          Filesize

          4KB

        • memory/1184-33-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-52-0x0000000003060000-0x000000000311E000-memory.dmp

          Filesize

          760KB

        • memory/1184-37-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-36-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-30-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-29-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-28-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-34-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-35-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-32-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-31-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-27-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-26-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/1184-40-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/1184-41-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/1184-42-0x0000000010000000-0x0000000010007000-memory.dmp

          Filesize

          28KB

        • memory/1184-53-0x0000000003120000-0x00000000033E9000-memory.dmp

          Filesize

          2.8MB

        • memory/1804-13-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-10-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-4-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-17-0x0000000000421000-0x0000000000422000-memory.dmp

          Filesize

          4KB

        • memory/1804-18-0x0000000000400000-0x0000000000472000-memory.dmp

          Filesize

          456KB

        • memory/1804-15-0x0000000002C10000-0x0000000002C39000-memory.dmp

          Filesize

          164KB

        • memory/1804-12-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-14-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-5-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-3-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-11-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-7-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-9-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-8-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-6-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1804-2-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/3940-51-0x0000014278520000-0x0000014278521000-memory.dmp

          Filesize

          4KB

        • memory/3940-47-0x0000000010000000-0x000000001001E000-memory.dmp

          Filesize

          120KB