0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73

Analysis

max time kernel
39s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe
Size

92KB
MD5

514eec0969b7c1db5b75289374dbeb39
SHA1

1cff2d6d109567941e4a92df1a1b7ccd8f3ae608
SHA256

0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73
SHA512

052f4182e3f45a505e5489b0d806ce4693f3b062f5c92ad8410a646f5d4fe25f2eac58b46423ebcc8ee045d972fb4e3daf8789c1349d0c3fcdbaf654b86c387e
SSDEEP

1536:WiOBKDP+vAXS2N5h9HPUWlmz60lHjZUMpkPVPSPkP4PjPIkbohaWdV7NObzHweyR:OaGb2N5tlmz60l2YbohacATw8NCv7t

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1948	neeek.exe

Loads dropped DLL 2 IoCs

pid	Process
1612	0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe
1612	0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1612	0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe
1948	neeek.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1948	1612	0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe	26
PID 1612 wrote to memory of 1948	1612	0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe	26
PID 1612 wrote to memory of 1948	1612	0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe	26
PID 1612 wrote to memory of 1948	1612	0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe	26

C:\Users\Admin\AppData\Local\Temp\0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe
"C:\Users\Admin\AppData\Local\Temp\0308de21b5648a9c7fb7f487fee627bad12846196367d44fec17e839209b1d73.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\neeek.exe
  "C:\Users\Admin\neeek.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\neeek.exe

Filesize
92KB

MD5
ab5c49b932abeff66f8b21aacafab8aa

SHA1
31f1e968ecf28420265584c786e9a3b38c6b97ae

SHA256
6446e1510cd6a0ce8e3c12c336db0cd9fd10a95839fe3cf87b9c441c43d98e4b

SHA512
79dd99b44a60343fda4b1e1710d8db68ae7674115e24c2ca7951d2ff5298a2c628ce403f2357a5e205004b25e0a4b3cc47643f55434a6ad40b391215bd17cadc

Download Submit
C:\Users\Admin\neeek.exe

Filesize
92KB

MD5
ab5c49b932abeff66f8b21aacafab8aa

SHA1
31f1e968ecf28420265584c786e9a3b38c6b97ae

SHA256
6446e1510cd6a0ce8e3c12c336db0cd9fd10a95839fe3cf87b9c441c43d98e4b

SHA512
79dd99b44a60343fda4b1e1710d8db68ae7674115e24c2ca7951d2ff5298a2c628ce403f2357a5e205004b25e0a4b3cc47643f55434a6ad40b391215bd17cadc

Download Submit
\Users\Admin\neeek.exe

Filesize
92KB

MD5
ab5c49b932abeff66f8b21aacafab8aa

SHA1
31f1e968ecf28420265584c786e9a3b38c6b97ae

SHA256
6446e1510cd6a0ce8e3c12c336db0cd9fd10a95839fe3cf87b9c441c43d98e4b

SHA512
79dd99b44a60343fda4b1e1710d8db68ae7674115e24c2ca7951d2ff5298a2c628ce403f2357a5e205004b25e0a4b3cc47643f55434a6ad40b391215bd17cadc

Download Submit
\Users\Admin\neeek.exe

Filesize
92KB

MD5
ab5c49b932abeff66f8b21aacafab8aa

SHA1
31f1e968ecf28420265584c786e9a3b38c6b97ae

SHA256
6446e1510cd6a0ce8e3c12c336db0cd9fd10a95839fe3cf87b9c441c43d98e4b

SHA512
79dd99b44a60343fda4b1e1710d8db68ae7674115e24c2ca7951d2ff5298a2c628ce403f2357a5e205004b25e0a4b3cc47643f55434a6ad40b391215bd17cadc

Download Submit
memory/1612-56-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download