7bf70042adf8d9776e89b699666acc356a56e070f69e95b67fe184c794783382

Analysis

max time kernel
151s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe
Size

272KB
MD5

9d6667c5a27a727bc2e7f7a225d7d940
SHA1

e829192238f92ed0dbcc0e284e6a7c427a8463c7
SHA256

7bf70042adf8d9776e89b699666acc356a56e070f69e95b67fe184c794783382
SHA512

070dd37ec2dc202413890ff21e7573a5638b0ed38693f391a51beeadd4be14ecf8380fdc1bd2f22cef3cb96efcf6db3addadd838d41126da6c22bb318cac9ad8
SSDEEP

6144:gtCqTBNolNkEqDtNSJa1oYJYJCvVZQGp/SitoG7JoxL:gtCqT2rybSJuoCv/QGpqZGdK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1924	B184.tmp

Loads dropped DLL 2 IoCs

pid	Process
2128	NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe
2128	NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.sfx	B184.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	B184.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1924	2128	NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe	28
PID 2128 wrote to memory of 1924	2128	NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe	28
PID 2128 wrote to memory of 1924	2128	NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe	28
PID 2128 wrote to memory of 1924	2128	NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9d6667c5a27a727bc2e7f7a225d7d940.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\B184.tmp
  C:\Users\Admin\AppData\Local\Temp\B184.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B184.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\B184.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\B184.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\B184.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\B184.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2128-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2128-1-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/2128-0-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads