65ab1d90c2180aa992c41b577b48a3737230b1f762089868cb62c0fa3cda5225

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2023 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe
Size

29KB
MD5

efb9d4ecff40b80a0fa7ce643e3df055
SHA1

5a50f0c97d3d7658a9431e6e78be80d38c16ecbd
SHA256

65ab1d90c2180aa992c41b577b48a3737230b1f762089868cb62c0fa3cda5225
SHA512

c19fdd714bc8c5e2a288097bdd34249d5eb02f5710178d9012644dc0e12645c5bc2ed1d27d2845cd41cc53c802a2a56704ac3b4618b3b79264c1f6e912f70c49
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/P:AEwVs+0jNDY1qi/qX

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3480	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0009000000023211-4.dat	upx
behavioral2/memory/3480-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0009000000023211-6.dat	upx
behavioral2/memory/5112-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3480-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3480-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000b00000002322f-55.dat	upx
behavioral2/memory/5112-89-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3480-90-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5112-142-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3480-148-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5112-191-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3480-195-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5112-245-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3480-246-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5112-288-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3480-289-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5112-333-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3480-334-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe
File opened for modification	C:\Windows\java.exe	NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe
File created	C:\Windows\java.exe	NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3480	5112	NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe	86
PID 5112 wrote to memory of 3480	5112	NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe	86
PID 5112 wrote to memory of 3480	5112	NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.efb9d4ecff40b80a0fa7ce643e3df055exe_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7R28S588\default[4].htm

Filesize
304B

MD5
8251fff4df202c8d6dd6aaf34f4838ea

SHA1
fa88f08dfdeaff6b86873d447fd26cb7d83a694d

SHA256
a17db628f6bdbf4cdc6fe029542404867306406510dbbdb57a047a75ac294962

SHA512
e9c0fe2a920377777bdda16a8744cf80d15e1d1b3c94b704f8a4c4cf54d2529ede4aea8a2d6d38f4e3c4d02f602edfed659db6613ac7c374e5214a201f16a3b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GJQPG6SR\default[2].htm

Filesize
304B

MD5
605de1f61d0446f81e63c25750e99301

SHA1
0eaf9121f9dc1338807a511f92ea0b30dc2982a5

SHA256
049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

SHA512
a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GJQPG6SR\default[3].htm

Filesize
305B

MD5
2c4ce699b73ce3278646321d836aca40

SHA1
72ead77fbd91cfadae8914cbb4c023a618bf0bd1

SHA256
e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

SHA512
89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GJQPG6SR\default[5].htm

Filesize
315B

MD5
058e41d2b5063436d4aa0b002fd7e569

SHA1
96a4ca8e2491c6b39717b65ad133d585bc075d62

SHA256
e9db8fcc986290d2376d5478a7c5a524c2949a0ef2e8c18d56b052b6841359cc

SHA512
6e55d73e1d091f5a7e886fa08ce3c27a38ff3d70c64ab099b9c285b2437817e6228b79461aa67ef1983df1fddb790445eb7a5bc9156a82a77b3cf6c0dfdc5dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEITGDYC\default[1].htm

Filesize
302B

MD5
485828cfdc2c1efc0c51ff9b74dd34f8

SHA1
6f685134b031e9b2fff0eb8c7212c99bfba3719f

SHA256
615a15f6247f8f979b3a066801c98489018b1d137fd5d9b7bce73824acc70f06

SHA512
69736b9700c2f47feab282d8bf8bd6f02c9f62ecb9c02466b6cf76b1cd4b1becc70803123e73427c871c2aeb2eb64540edf95a342f78d9211ac0571e8fd1f426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XE9C1B9R\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fzn8.log

Filesize
256B

MD5
9fdb38557c3e3bd0940f4907883853ba

SHA1
85e830c7af88e799e4cfbae373d4201b5face168

SHA256
4ad028c6eb57698a1a05b7574a6cfdcf898bf437d28842c8e810004c75ec413d

SHA512
5cb3fc9312dc5270037af0e4196d635fe6aa3ac9b5547c2070f1b239cf45cec87550199af8ee8fde4352b4fe67626f083fabcb09689d7179cf4deac1242cec5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCC56.tmp

Filesize
29KB

MD5
1cf1c3eaa770c366e56f009e798ff645

SHA1
daa9fe8bb54cf729d33cb2e4de00e41f6ad8f2ff

SHA256
43c44831d5f3b4e02d58bcd3c128ccdbdff6a5044bb730186062eb3f0c81b737

SHA512
11875c864d8614d992d8dd4e38f3da4080598adcaa1f2bf7b4f53c113e97f9e6bc7d1835317b0d5ed3c9d349aba311dec6bb40254719cbb9133037376bc6feb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
144ce1f9fb899214b306b32c392a4996

SHA1
743ed6936caaa503d04c4a3138f3b21a2ea0a811

SHA256
eb1d99180e4944352f53930b922d9dc1a0a4b8e2aaca7325cc2b4dd3fc42eb2c

SHA512
09cda8f439638eac14ef503518f6489a4094dd61237a424a5a59231630a86465a300cb40e3be9513ca19f6cba8e1a3c04622dd276d2b0ff05451b9bd42cda465

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
95eaadd0cf985fe0b5270c2bd408eceb

SHA1
87d82acd7851592e003a05db9683c2ca499a5230

SHA256
f54b1ae212195b2959a970281eefcc1172ebc6a1e8f971f1c65026548eb47c77

SHA512
2cd459741b5ec13dd414da15ee67009e8907a04ecf25a60c01a41c70c47a93b123c0886fdaf9e0779a6ae1827523e2f920ee5c447ed9bb02735e25134c3db6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
ff471e57f32241d247a2b076f9a3f066

SHA1
0bd5b30f619c28624d5203f65f8b282e4ea3e1ef

SHA256
28f9606107c37b144e1875d71d334ab10402b543d045c1c81b80f10d615c9942

SHA512
66775116396b3cfaf9ca7de4cc88b48986a471358ea6ffb365d33b5fbba69b5dd9d2b671e86d8ebbdb7ced71fd0793ff83f3a249501abdca118acfe87a8db79e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3480-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-195-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-90-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-334-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-148-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-289-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3480-246-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5112-245-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5112-288-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5112-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5112-191-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5112-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5112-333-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5112-142-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5112-89-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads