d4fdcaaa343e920a730f313745bba137d6295d7bd3cd3a1a63164e499f78f8da

Analysis

max time kernel
128s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe
Size

72KB
MD5

f063baee8dd52de5153ed1842f401d8b
SHA1

53d31a52b09e069099aa59c9d34132adb4ed9f14
SHA256

d4fdcaaa343e920a730f313745bba137d6295d7bd3cd3a1a63164e499f78f8da
SHA512

6373a31124bd279a280a534de1c575d50076fdb13b37f58725c6e5f21b7c165a0d30c6a28c4a25205c14e17736ff02820d101a696b71fdf6688cdcb98bf01811
SSDEEP

768:4YnI9ZvPg2k4u+hJDdv260OAhAH4Ii7gLp6uqcl2aauA:4wIrHuCtd3FAhAYIi7Glba

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4332	dsnocoy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c79pj = "C:\\Users\\Admin\\AppData\\Roaming\\dsnocoy.exe"	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4332	3204	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe	85
PID 3204 wrote to memory of 4332	3204	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe	85
PID 3204 wrote to memory of 4332	3204	NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f063baee8dd52de5153ed1842f401d8b_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Roaming\dsnocoy.exe
  C:\Users\Admin\AppData\Roaming\dsnocoy.exe
  2⤵
  - Executes dropped EXE
  PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dsnocoy.exe

Filesize
72KB

MD5
1619298ce672dae5badfe7ca4a570c60

SHA1
d3b3b5194557bdebd616834b74322773effb9407

SHA256
b200d8b4bdd446659ce36f92b95e734fdc1ce7601d2da5463332e2ac30fea459

SHA512
cf75ac5a7d8a7012efa94491a836bebdf5142f328ed3a72e24f62e71d1318bbffc217fedf06fde821a6646a5ac91b4396ae10643ca11a04a94d41bb46d0abdb5

Download Submit
C:\Users\Admin\AppData\Roaming\dsnocoy.exe

Filesize
72KB

MD5
1619298ce672dae5badfe7ca4a570c60

SHA1
d3b3b5194557bdebd616834b74322773effb9407

SHA256
b200d8b4bdd446659ce36f92b95e734fdc1ce7601d2da5463332e2ac30fea459

SHA512
cf75ac5a7d8a7012efa94491a836bebdf5142f328ed3a72e24f62e71d1318bbffc217fedf06fde821a6646a5ac91b4396ae10643ca11a04a94d41bb46d0abdb5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads