d4fdcaaa343e920a730f313745bba137d6295d7bd3cd3a1a63164e499f78f8da

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe
Size

72KB
MD5

f063baee8dd52de5153ed1842f401d8b
SHA1

53d31a52b09e069099aa59c9d34132adb4ed9f14
SHA256

d4fdcaaa343e920a730f313745bba137d6295d7bd3cd3a1a63164e499f78f8da
SHA512

6373a31124bd279a280a534de1c575d50076fdb13b37f58725c6e5f21b7c165a0d30c6a28c4a25205c14e17736ff02820d101a696b71fdf6688cdcb98bf01811
SSDEEP

768:4YnI9ZvPg2k4u+hJDdv260OAhAH4Ii7gLp6uqcl2aauA:4wIrHuCtd3FAhAYIi7Glba

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1236	5huo.exe

Loads dropped DLL 2 IoCs

pid	Process
2968	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe
2968	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\swcqn = "C:\\Users\\Admin\\AppData\\Roaming\\5huo.exe"	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1236	2968	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe	28
PID 2968 wrote to memory of 1236	2968	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe	28
PID 2968 wrote to memory of 1236	2968	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe	28
PID 2968 wrote to memory of 1236	2968	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Roaming\5huo.exe
  C:\Users\Admin\AppData\Roaming\5huo.exe
  2⤵
  - Executes dropped EXE
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\5huo.exe

Filesize
72KB

MD5
4e1ca63b9b16a9f1d1cf756693ba9132

SHA1
325e2e54cee3f1fb86d671eb0b43844c441ffb83

SHA256
05e4121b4224058c9a6a3d012c699cc24b0174ef008ff589753216779527aed5

SHA512
3b30a2f1159fd0ec9c7a5a7ab19205a4ea2513182dcc8dcf8c2354a92b3db1f1387d60463550a5b476f6c03675580522823f9290aa87f7f74788a2c078d71a9d

Download Submit
C:\Users\Admin\AppData\Roaming\5huo.exe

Filesize
72KB

MD5
4e1ca63b9b16a9f1d1cf756693ba9132

SHA1
325e2e54cee3f1fb86d671eb0b43844c441ffb83

SHA256
05e4121b4224058c9a6a3d012c699cc24b0174ef008ff589753216779527aed5

SHA512
3b30a2f1159fd0ec9c7a5a7ab19205a4ea2513182dcc8dcf8c2354a92b3db1f1387d60463550a5b476f6c03675580522823f9290aa87f7f74788a2c078d71a9d

Download Submit
C:\Users\Admin\AppData\Roaming\5huo.exe

Filesize
72KB

MD5
4e1ca63b9b16a9f1d1cf756693ba9132

SHA1
325e2e54cee3f1fb86d671eb0b43844c441ffb83

SHA256
05e4121b4224058c9a6a3d012c699cc24b0174ef008ff589753216779527aed5

SHA512
3b30a2f1159fd0ec9c7a5a7ab19205a4ea2513182dcc8dcf8c2354a92b3db1f1387d60463550a5b476f6c03675580522823f9290aa87f7f74788a2c078d71a9d

Download Submit
\Users\Admin\AppData\Roaming\5huo.exe

Filesize
72KB

MD5
4e1ca63b9b16a9f1d1cf756693ba9132

SHA1
325e2e54cee3f1fb86d671eb0b43844c441ffb83

SHA256
05e4121b4224058c9a6a3d012c699cc24b0174ef008ff589753216779527aed5

SHA512
3b30a2f1159fd0ec9c7a5a7ab19205a4ea2513182dcc8dcf8c2354a92b3db1f1387d60463550a5b476f6c03675580522823f9290aa87f7f74788a2c078d71a9d

Download Submit
\Users\Admin\AppData\Roaming\5huo.exe

Filesize
72KB

MD5
4e1ca63b9b16a9f1d1cf756693ba9132

SHA1
325e2e54cee3f1fb86d671eb0b43844c441ffb83

SHA256
05e4121b4224058c9a6a3d012c699cc24b0174ef008ff589753216779527aed5

SHA512
3b30a2f1159fd0ec9c7a5a7ab19205a4ea2513182dcc8dcf8c2354a92b3db1f1387d60463550a5b476f6c03675580522823f9290aa87f7f74788a2c078d71a9d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads