Analysis

  • max time kernel
    122s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 18:26

General

  • Target

    NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe

  • Size

    1.4MB

  • MD5

    4b45423fa806ba12d099173f6b4126f0

  • SHA1

    86b3f3ed6db3b6dd024359cff9f684d7f7d32903

  • SHA256

    e38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bc

  • SHA512

    deb0c606169094f47f386f66f41a76011e7ed3710d50d5bd682437054ac1e8a671fa36d0d5e79d50d2debc2b3b104fcdf0831054a40b7b555a30c54e44188a8b

  • SSDEEP

    24576:1yi2HBkN0hhWOga7AeHidUXuVVN8mwpKfLTBHBf/WA7hO/f6abYEsYT:QzHs2hW+AeJu+Kj1B2nmE9

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2608
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2920
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 272
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exe

    Filesize

    1.3MB

    MD5

    71c76e4535c31cb12fe199b9ffbb77c9

    SHA1

    948f00e196721bb38d23570965a5a0f512aac50f

    SHA256

    745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa

    SHA512

    f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exe

    Filesize

    1.3MB

    MD5

    71c76e4535c31cb12fe199b9ffbb77c9

    SHA1

    948f00e196721bb38d23570965a5a0f512aac50f

    SHA256

    745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa

    SHA512

    f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exe

    Filesize

    903KB

    MD5

    b636c65de3a0502e881f15ddf3044a81

    SHA1

    d051758765b18451e9731c811b6c32a5f6851e1f

    SHA256

    fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d

    SHA512

    5f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exe

    Filesize

    903KB

    MD5

    b636c65de3a0502e881f15ddf3044a81

    SHA1

    d051758765b18451e9731c811b6c32a5f6851e1f

    SHA256

    fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d

    SHA512

    5f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exe

    Filesize

    535KB

    MD5

    f3f1453113dda755af93227e69e82c4e

    SHA1

    18ff0a684ddeb60a8fe9a63090bfae5642247672

    SHA256

    bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84

    SHA512

    514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exe

    Filesize

    535KB

    MD5

    f3f1453113dda755af93227e69e82c4e

    SHA1

    18ff0a684ddeb60a8fe9a63090bfae5642247672

    SHA256

    bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84

    SHA512

    514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exe

    Filesize

    1.3MB

    MD5

    71c76e4535c31cb12fe199b9ffbb77c9

    SHA1

    948f00e196721bb38d23570965a5a0f512aac50f

    SHA256

    745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa

    SHA512

    f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exe

    Filesize

    1.3MB

    MD5

    71c76e4535c31cb12fe199b9ffbb77c9

    SHA1

    948f00e196721bb38d23570965a5a0f512aac50f

    SHA256

    745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa

    SHA512

    f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exe

    Filesize

    903KB

    MD5

    b636c65de3a0502e881f15ddf3044a81

    SHA1

    d051758765b18451e9731c811b6c32a5f6851e1f

    SHA256

    fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d

    SHA512

    5f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exe

    Filesize

    903KB

    MD5

    b636c65de3a0502e881f15ddf3044a81

    SHA1

    d051758765b18451e9731c811b6c32a5f6851e1f

    SHA256

    fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d

    SHA512

    5f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exe

    Filesize

    535KB

    MD5

    f3f1453113dda755af93227e69e82c4e

    SHA1

    18ff0a684ddeb60a8fe9a63090bfae5642247672

    SHA256

    bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84

    SHA512

    514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exe

    Filesize

    535KB

    MD5

    f3f1453113dda755af93227e69e82c4e

    SHA1

    18ff0a684ddeb60a8fe9a63090bfae5642247672

    SHA256

    bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84

    SHA512

    514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe

    Filesize

    232KB

    MD5

    3ff825411b1fe07e712a5dcae34f80eb

    SHA1

    e3e4358cabfa74d6e36e26754b01ed78434a6877

    SHA256

    69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

    SHA512

    325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

  • memory/2920-41-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2920-45-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2920-49-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2920-47-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2920-44-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2920-40-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2920-42-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2920-43-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB