Analysis
-
max time kernel
117s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13-10-2023 20:33
General
-
Target
NEAS.a171f5dba798998c17c7e3b32e03bc20.exe
-
Size
172KB
-
MD5
a171f5dba798998c17c7e3b32e03bc20
-
SHA1
a70fcb0aa70deab6e38ccc153016096cfa855cbe
-
SHA256
1a5e8d79270112482106b5fb05fffa0e3c698e7824aa55eb7234362846cd7384
-
SHA512
7789da87b352f0cdfb69eb178b23c02ec7f7871d4435550471f1ebfb3dd0fcdcb6f4b17d7864e5119182a52d72fa2fe347db76663d4a23b0f0f97b580b7f74e6
-
SSDEEP
3072:sNf3wRqQxKvxnsRcaCBL7TURxZPQeQ6DHtsamoBz:8PeyxTVTOZPQRIHrmoB
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a171f5dba798998c17c7e3b32e03bc20.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a171f5dba798998c17c7e3b32e03bc20.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\1ec01f74.exeC:\1ec01f74.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD59df97113d4fb0462ca99208668d6102a
SHA12b769b8615735bea0592c73b16ebab7baeedca98
SHA2569b0fa329aa52f505162bcaeb1bb3ca4ecb1543ec4a9640d7fe8f9fab7668d974
SHA512c2b9b619f608ec561a81fc5532a47d876f3a4b092babe8d2524c7055ba922f3d85ca9932698b692850d767884e0cdebce39838b5fea9cb6177645c5bb6867a6a
-
Filesize
81KB
MD59df97113d4fb0462ca99208668d6102a
SHA12b769b8615735bea0592c73b16ebab7baeedca98
SHA2569b0fa329aa52f505162bcaeb1bb3ca4ecb1543ec4a9640d7fe8f9fab7668d974
SHA512c2b9b619f608ec561a81fc5532a47d876f3a4b092babe8d2524c7055ba922f3d85ca9932698b692850d767884e0cdebce39838b5fea9cb6177645c5bb6867a6a
-
Filesize
81KB
MD59df97113d4fb0462ca99208668d6102a
SHA12b769b8615735bea0592c73b16ebab7baeedca98
SHA2569b0fa329aa52f505162bcaeb1bb3ca4ecb1543ec4a9640d7fe8f9fab7668d974
SHA512c2b9b619f608ec561a81fc5532a47d876f3a4b092babe8d2524c7055ba922f3d85ca9932698b692850d767884e0cdebce39838b5fea9cb6177645c5bb6867a6a
-
Filesize
720B
MD532c5426034640e5e2a9c5242b0f91d1a
SHA1d3a36389bf9934ac0d568bea09de8df904f337e7
SHA256968e4be7a43f4043fc35f2381b69e2de209bf53e8ea6977552541f80e43dd079
SHA5122e2f00f0f5bd3b978ad88e1ee8a49747e3dd2a35c29aa9f68e8259ecce05b7344c1a8bf73d31a6464537b10aa30c9d6bb3851c8be9362d70a896c313da2cdc70
-
Filesize
81KB
MD585b9df4b276647aa1170e21b5ce580a5
SHA1081d4d7f83660724cbe256401870d7a2310bda12
SHA2563b282419c0747296c11ea4ba8b92b775378fdb553e60900b61c8902864e7efeb
SHA512ab0d70323bc470f2620659fa9a790ff1bc21cbbca6a642880414bea303c53feaee8743526005d43ce136ce7812c4cd1f26a843bd9be822341f98d39dc37b20f5
-
Filesize
81KB
MD585b9df4b276647aa1170e21b5ce580a5
SHA1081d4d7f83660724cbe256401870d7a2310bda12
SHA2563b282419c0747296c11ea4ba8b92b775378fdb553e60900b61c8902864e7efeb
SHA512ab0d70323bc470f2620659fa9a790ff1bc21cbbca6a642880414bea303c53feaee8743526005d43ce136ce7812c4cd1f26a843bd9be822341f98d39dc37b20f5
-
Filesize
81KB
MD585b9df4b276647aa1170e21b5ce580a5
SHA1081d4d7f83660724cbe256401870d7a2310bda12
SHA2563b282419c0747296c11ea4ba8b92b775378fdb553e60900b61c8902864e7efeb
SHA512ab0d70323bc470f2620659fa9a790ff1bc21cbbca6a642880414bea303c53feaee8743526005d43ce136ce7812c4cd1f26a843bd9be822341f98d39dc37b20f5
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
144KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
384KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
384KB
-
Filesize
144KB