3bc02e08f8127c003a21f12a0aee395523c977df366260605084e86eab1d2d18

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1711de7708b0464d51f73a38553578a0.exe
Size

255KB
MD5

1711de7708b0464d51f73a38553578a0
SHA1

24cdcc930d57c601ac1feb3f47aef44cd97a0bf8
SHA256

3bc02e08f8127c003a21f12a0aee395523c977df366260605084e86eab1d2d18
SHA512

5dd6e3835388df9b01e63120dd48e001c361b95fcc9dd802056c1bbcd10a2a934fdc060b4aa09a368a6c1b35a9f5d5fedb7a23320006d89459b6125772f9f033
SSDEEP

6144:5eIk0YujFHsS3jwc25qXIXakFzrAcJFWyQ5dwws:AXxujdec24YX7JM2MjDs

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3544	xxmjpmn.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\xxmjpmn.exe	NEAS.1711de7708b0464d51f73a38553578a0.exe
File created	C:\PROGRA~3\Mozilla\yscklod.dll	xxmjpmn.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.1711de7708b0464d51f73a38553578a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1711de7708b0464d51f73a38553578a0.exe"
1⤵
- Drops file in Program Files directory
PID:4960

C:\PROGRA~3\Mozilla\xxmjpmn.exe
C:\PROGRA~3\Mozilla\xxmjpmn.exe -nznotnb
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\xxmjpmn.exe

Filesize
255KB

MD5
113394e7a8c5d389e268ede3c6c7aa2a

SHA1
51317005b2686ce3e0e4f8c284ab539b38364097

SHA256
32891092c768379e43755467f419ba1e10125871440d98f0efdc5728ba3bb06b

SHA512
3e2999310c471a2ce87b382dba366825ed3943d655b794e2dec355b962090d89e269d8fd4ff77e31e16918c84486fa6d737b9ede2df4c4f4ea5d66600f03c8c2

Download Submit
C:\ProgramData\Mozilla\xxmjpmn.exe

Filesize
255KB

MD5
113394e7a8c5d389e268ede3c6c7aa2a

SHA1
51317005b2686ce3e0e4f8c284ab539b38364097

SHA256
32891092c768379e43755467f419ba1e10125871440d98f0efdc5728ba3bb06b

SHA512
3e2999310c471a2ce87b382dba366825ed3943d655b794e2dec355b962090d89e269d8fd4ff77e31e16918c84486fa6d737b9ede2df4c4f4ea5d66600f03c8c2

Download Submit
memory/3544-9-0x0000000000D60000-0x0000000000DBB000-memory.dmp

Filesize
364KB

Download
memory/3544-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3544-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3544-14-0x0000000000D60000-0x0000000000DBB000-memory.dmp

Filesize
364KB

Download
memory/4960-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4960-1-0x00000000020C0000-0x000000000211B000-memory.dmp

Filesize
364KB

Download
memory/4960-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4960-5-0x00000000020C0000-0x000000000211B000-memory.dmp

Filesize
364KB

Download
memory/4960-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download