Analysis

  • max time kernel
    144s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 15:21

General

  • Target

    NEAS.NEAS4b260d52a8a71b822e9cd9171d76cd0cexe_JC.exe

  • Size

    486KB

  • MD5

    4b260d52a8a71b822e9cd9171d76cd0c

  • SHA1

    acad34ea375f7c6618be2950d38685eb7835b9ad

  • SHA256

    cd3f866409fb1062a976c4f6fd659f34a5407d313e3448abad8d011d401d7148

  • SHA512

    11c5dafb653b2271e983651f7aadda0f0d78ae61a8c100720878dcb2e7b6917a44a93329faa77f06d9d6bdde1b7b458155597d7c2e8c897dba52e69fa5bcf31c

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS4b260d52a8a71b822e9cd9171d76cd0cexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS4b260d52a8a71b822e9cd9171d76cd0cexe_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:3596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

      Filesize

      486KB

      MD5

      4b260d52a8a71b822e9cd9171d76cd0c

      SHA1

      acad34ea375f7c6618be2950d38685eb7835b9ad

      SHA256

      cd3f866409fb1062a976c4f6fd659f34a5407d313e3448abad8d011d401d7148

      SHA512

      11c5dafb653b2271e983651f7aadda0f0d78ae61a8c100720878dcb2e7b6917a44a93329faa77f06d9d6bdde1b7b458155597d7c2e8c897dba52e69fa5bcf31c

    • \??\c:\$$$$$.bat

      Filesize

      230B

      MD5

      fa6c2c9539900c2ed204031e220382ba

      SHA1

      36e5bb4bfee5f40e1bc941852cc00fa1be63e54e

      SHA256

      911eb8a77a453e2be700ba5626acd220c9f7f83bd4e45c19f43068d3b510b520

      SHA512

      6300298da031330a2dfffd87bb2eb49dc620eaf8896199e0043826b03624f855b3cc7c168432c3704a86d5a47b4b0c0195614abe015a6adfa7a874c5da35d861

    • memory/4828-0-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4828-479-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4828-821-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB