Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13/10/2023, 20:28
General
-
Target
NEAS.797c98d58933c6fdfc8dd93792357de0.exe
-
Size
444KB
-
MD5
797c98d58933c6fdfc8dd93792357de0
-
SHA1
97b36c69e8873cc6e35fecb1794657315f22626e
-
SHA256
5a2c6ebdd5947c67fcd098da4e88723f738fd02dfa3d60769b921bd5d4c12296
-
SHA512
04107cd892dc91a1d905db93c3f71901371c552bc37e21b30a55a254e274badd3caf8b33359da82b85c9d81e5f343b77c447f07eb443a88347e871adf006a5f4
-
SSDEEP
12288:Nb4bZudi79LwoQrERXZBvGOxD+OSJg2A:Nb4bcdkLyrERXZFxDrSJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.797c98d58933c6fdfc8dd93792357de0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.797c98d58933c6fdfc8dd93792357de0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp" --helpC:\Users\Admin\AppData\Local\Temp\NEAS.797c98d58933c6fdfc8dd93792357de0.exe 0208D045BD080D8741500B13A1E4FA0872F21500E3B43657C349E660630273A806C999F5E16458B7BB522B1753D799AC45659C3846015DAE274FF08816F962622⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD59d1c1649f6814bdea2c6ae6ae4257e08
SHA151a34256a218be6ec6a7862d8bc5a55ff1bce0bc
SHA2565402a3e8d523f99beeec1c26ed9ecdfc1fff8001810c04179b334884677125d1
SHA512167744b1155f34440400b7e858c816c89802b58fa14c79a409b4c6319900b046c22127972041165a738cf5699ae0993dd94fda4a3955f9350718cb61bdf74a3a
-
Filesize
444KB
MD59d1c1649f6814bdea2c6ae6ae4257e08
SHA151a34256a218be6ec6a7862d8bc5a55ff1bce0bc
SHA2565402a3e8d523f99beeec1c26ed9ecdfc1fff8001810c04179b334884677125d1
SHA512167744b1155f34440400b7e858c816c89802b58fa14c79a409b4c6319900b046c22127972041165a738cf5699ae0993dd94fda4a3955f9350718cb61bdf74a3a