538c527f04dc48345502a1315096785a2b8574b196a6dad735a81e59f375198e

Analysis

max time kernel
152s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe
Size

35KB
MD5

13d1a45039fed3faf1c46fd3ec2608c0
SHA1

a40dee827246789b1eb672eead2671ea2d1f6373
SHA256

538c527f04dc48345502a1315096785a2b8574b196a6dad735a81e59f375198e
SHA512

180fb5c02890fdc541abb55f51486ac0055fe575184f96919d0826f1fde5c1a0f3fafee411e6f53cf36c29fb8a6bd150c08903582efdbbb372a6185728ae9050
SSDEEP

768:WWH6E4y5Uiy1SssZqdoadXFrC8EBXbuLRCShkgJ:WWH6E4y58SsskdoadXZH6bVa

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2188	ukyfact.exe

Loads dropped DLL 2 IoCs

pid	Process
2960	NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe
2960	NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2960-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/files/0x000900000000e621-4.dat	upx
behavioral1/files/0x000900000000e621-6.dat	upx
behavioral1/memory/2188-13-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/files/0x000900000000e621-12.dat	upx
behavioral1/files/0x000900000000e621-8.dat	upx
behavioral1/files/0x000900000000e621-15.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2188	2960	NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe	28
PID 2960 wrote to memory of 2188	2960	NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe	28
PID 2960 wrote to memory of 2188	2960	NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe	28
PID 2960 wrote to memory of 2188	2960	NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.13d1a45039fed3faf1c46fd3ec2608c0_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\ukyfact.exe
  "C:\Users\Admin\AppData\Local\Temp\ukyfact.exe"
  2⤵
  - Executes dropped EXE
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ukyfact.exe

Filesize
35KB

MD5
3d5ffbe87057987997af0f143099de54

SHA1
75f98c0821d9cf188b300f8ea0c1853c14290f40

SHA256
b79acbbeafac78696856fa8e0cfe9a5e37c9a106682ec2ef922afebe2a6cb413

SHA512
d54ba128985805091ac2c3b133d1fc00fc9b3246d367559e41edfe2af05477dff913082a6ddf08627c51ccd0cc631329f9544feba0158d0042daac79a02a112d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ukyfact.exe

Filesize
35KB

MD5
3d5ffbe87057987997af0f143099de54

SHA1
75f98c0821d9cf188b300f8ea0c1853c14290f40

SHA256
b79acbbeafac78696856fa8e0cfe9a5e37c9a106682ec2ef922afebe2a6cb413

SHA512
d54ba128985805091ac2c3b133d1fc00fc9b3246d367559e41edfe2af05477dff913082a6ddf08627c51ccd0cc631329f9544feba0158d0042daac79a02a112d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ukyfact.exe

Filesize
35KB

MD5
3d5ffbe87057987997af0f143099de54

SHA1
75f98c0821d9cf188b300f8ea0c1853c14290f40

SHA256
b79acbbeafac78696856fa8e0cfe9a5e37c9a106682ec2ef922afebe2a6cb413

SHA512
d54ba128985805091ac2c3b133d1fc00fc9b3246d367559e41edfe2af05477dff913082a6ddf08627c51ccd0cc631329f9544feba0158d0042daac79a02a112d

Download Submit
\Users\Admin\AppData\Local\Temp\ukyfact.exe

Filesize
35KB

MD5
3d5ffbe87057987997af0f143099de54

SHA1
75f98c0821d9cf188b300f8ea0c1853c14290f40

SHA256
b79acbbeafac78696856fa8e0cfe9a5e37c9a106682ec2ef922afebe2a6cb413

SHA512
d54ba128985805091ac2c3b133d1fc00fc9b3246d367559e41edfe2af05477dff913082a6ddf08627c51ccd0cc631329f9544feba0158d0042daac79a02a112d

Download Submit
\Users\Admin\AppData\Local\Temp\ukyfact.exe

Filesize
35KB

MD5
3d5ffbe87057987997af0f143099de54

SHA1
75f98c0821d9cf188b300f8ea0c1853c14290f40

SHA256
b79acbbeafac78696856fa8e0cfe9a5e37c9a106682ec2ef922afebe2a6cb413

SHA512
d54ba128985805091ac2c3b133d1fc00fc9b3246d367559e41edfe2af05477dff913082a6ddf08627c51ccd0cc631329f9544feba0158d0042daac79a02a112d

Download Submit
memory/2188-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2188-14-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2960-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2960-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2960-10-0x0000000002C80000-0x0000000002CA2000-memory.dmp

Filesize
136KB

Download