e2a91b70af3d16550ca56fb68f1e9c4095773a9f5a07ff754a2f0ebb182fe7d8

Analysis

max time kernel
151s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.28b06fccca93cac6018b31f3842c31f0.exe
Size

88KB
MD5

28b06fccca93cac6018b31f3842c31f0
SHA1

9dd49ea04c383f3adef773a18f59a7025b9248cf
SHA256

e2a91b70af3d16550ca56fb68f1e9c4095773a9f5a07ff754a2f0ebb182fe7d8
SHA512

58fd5b188f65dbb2b19b20890a894edb348126671642576a7f3336d28ce3c60cca7855f147b933f62190facffc9a0f75f5e2127f6b43c5a0994a96bc1332df92
SSDEEP

1536:HKiJCGGi39mF3OpIfEabJdvOW8h+ZrNr8lvuvmqd4FOejogFPGa/ip5yp:HKHi39E5Eash2mlhBOejooPGa/ocp

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	prints.exe

Loads dropped DLL 3 IoCs

pid	Process
2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe
2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe
2692	prints.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/files/0x002f000000014963-8.dat	upx
behavioral1/files/0x002f000000014963-13.dat	upx
behavioral1/memory/2356-24-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/memory/2692-26-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/files/0x002f000000014963-23.dat	upx
behavioral1/files/0x002f000000014963-10.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSysQQ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\prints.exe"	prints.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe
2692	prints.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2692	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	28
PID 2356 wrote to memory of 2692	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	28
PID 2356 wrote to memory of 2692	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	28
PID 2356 wrote to memory of 2692	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	28
PID 2356 wrote to memory of 2700	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	30
PID 2356 wrote to memory of 2700	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	30
PID 2356 wrote to memory of 2700	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	30
PID 2356 wrote to memory of 2700	2356	NEAS.28b06fccca93cac6018b31f3842c31f0.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.28b06fccca93cac6018b31f3842c31f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.28b06fccca93cac6018b31f3842c31f0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\prints.exe
  C:\Users\Admin\AppData\Local\Temp\prints.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\Deleteme.bat
  2⤵
  - Deletes itself
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Deleteme.bat

Filesize
194B

MD5
73ce26fbe56b8ba482fa28645c52ce40

SHA1
a035d428bb4cb6f630b7089a2bec8323ddbefde5

SHA256
850bfcc65a371971152aff638988dbc533070d06dfc43399847dbfb7fa1e9726

SHA512
9488d10158a0788a3459178e26a2dcbee2330db994da2d755d125346e1c83b5ff7889a4302462121391714cf84fdcff26f55652141f38cec2bda3a1830a138ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deleteme.bat

Filesize
194B

MD5
73ce26fbe56b8ba482fa28645c52ce40

SHA1
a035d428bb4cb6f630b7089a2bec8323ddbefde5

SHA256
850bfcc65a371971152aff638988dbc533070d06dfc43399847dbfb7fa1e9726

SHA512
9488d10158a0788a3459178e26a2dcbee2330db994da2d755d125346e1c83b5ff7889a4302462121391714cf84fdcff26f55652141f38cec2bda3a1830a138ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntshruis2.dll

Filesize
100KB

MD5
2a65cea9b055ce4ed42edbd4e356a1d4

SHA1
50be987e1b846385c00ae77dc6f8a1b30070fa50

SHA256
3e8eb17dd4f927991307eeecfcd01c2fb16383c25e282b0e39faf4f2460d4503

SHA512
e73578073bcaff87927aa0c20bf062c3afa20a70488934b3945b8b80d50cfba34e486d5e9cee92acd7c66d86aa123a0489e1bba22815b8ecdd1250a1bd5b6682

Download Submit
C:\Users\Admin\AppData\Local\Temp\prints.exe

Filesize
88KB

MD5
28b06fccca93cac6018b31f3842c31f0

SHA1
9dd49ea04c383f3adef773a18f59a7025b9248cf

SHA256
e2a91b70af3d16550ca56fb68f1e9c4095773a9f5a07ff754a2f0ebb182fe7d8

SHA512
58fd5b188f65dbb2b19b20890a894edb348126671642576a7f3336d28ce3c60cca7855f147b933f62190facffc9a0f75f5e2127f6b43c5a0994a96bc1332df92

Download Submit
C:\Users\Admin\AppData\Local\Temp\prints.exe

Filesize
88KB

MD5
28b06fccca93cac6018b31f3842c31f0

SHA1
9dd49ea04c383f3adef773a18f59a7025b9248cf

SHA256
e2a91b70af3d16550ca56fb68f1e9c4095773a9f5a07ff754a2f0ebb182fe7d8

SHA512
58fd5b188f65dbb2b19b20890a894edb348126671642576a7f3336d28ce3c60cca7855f147b933f62190facffc9a0f75f5e2127f6b43c5a0994a96bc1332df92

Download Submit
\Users\Admin\AppData\Local\Temp\ntshruis2.dll

Filesize
100KB

MD5
2a65cea9b055ce4ed42edbd4e356a1d4

SHA1
50be987e1b846385c00ae77dc6f8a1b30070fa50

SHA256
3e8eb17dd4f927991307eeecfcd01c2fb16383c25e282b0e39faf4f2460d4503

SHA512
e73578073bcaff87927aa0c20bf062c3afa20a70488934b3945b8b80d50cfba34e486d5e9cee92acd7c66d86aa123a0489e1bba22815b8ecdd1250a1bd5b6682

Download Submit
\Users\Admin\AppData\Local\Temp\prints.exe

Filesize
88KB

MD5
28b06fccca93cac6018b31f3842c31f0

SHA1
9dd49ea04c383f3adef773a18f59a7025b9248cf

SHA256
e2a91b70af3d16550ca56fb68f1e9c4095773a9f5a07ff754a2f0ebb182fe7d8

SHA512
58fd5b188f65dbb2b19b20890a894edb348126671642576a7f3336d28ce3c60cca7855f147b933f62190facffc9a0f75f5e2127f6b43c5a0994a96bc1332df92

Download Submit
\Users\Admin\AppData\Local\Temp\prints.exe

Filesize
88KB

MD5
28b06fccca93cac6018b31f3842c31f0

SHA1
9dd49ea04c383f3adef773a18f59a7025b9248cf

SHA256
e2a91b70af3d16550ca56fb68f1e9c4095773a9f5a07ff754a2f0ebb182fe7d8

SHA512
58fd5b188f65dbb2b19b20890a894edb348126671642576a7f3336d28ce3c60cca7855f147b933f62190facffc9a0f75f5e2127f6b43c5a0994a96bc1332df92

Download Submit
memory/2356-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2356-16-0x0000000000220000-0x0000000000254000-memory.dmp

Filesize
208KB

Download
memory/2356-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2692-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2692-28-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/2692-31-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/2692-39-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download