Analysis
-
max time kernel
156s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13-10-2023 20:33
General
-
Target
NEAS.a171f5dba798998c17c7e3b32e03bc20.exe
-
Size
172KB
-
MD5
a171f5dba798998c17c7e3b32e03bc20
-
SHA1
a70fcb0aa70deab6e38ccc153016096cfa855cbe
-
SHA256
1a5e8d79270112482106b5fb05fffa0e3c698e7824aa55eb7234362846cd7384
-
SHA512
7789da87b352f0cdfb69eb178b23c02ec7f7871d4435550471f1ebfb3dd0fcdcb6f4b17d7864e5119182a52d72fa2fe347db76663d4a23b0f0f97b580b7f74e6
-
SSDEEP
3072:sNf3wRqQxKvxnsRcaCBL7TURxZPQeQ6DHtsamoBz:8PeyxTVTOZPQRIHrmoB
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a171f5dba798998c17c7e3b32e03bc20.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a171f5dba798998c17c7e3b32e03bc20.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\1ec01f74.exeC:\1ec01f74.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD59df97113d4fb0462ca99208668d6102a
SHA12b769b8615735bea0592c73b16ebab7baeedca98
SHA2569b0fa329aa52f505162bcaeb1bb3ca4ecb1543ec4a9640d7fe8f9fab7668d974
SHA512c2b9b619f608ec561a81fc5532a47d876f3a4b092babe8d2524c7055ba922f3d85ca9932698b692850d767884e0cdebce39838b5fea9cb6177645c5bb6867a6a
-
Filesize
81KB
MD59df97113d4fb0462ca99208668d6102a
SHA12b769b8615735bea0592c73b16ebab7baeedca98
SHA2569b0fa329aa52f505162bcaeb1bb3ca4ecb1543ec4a9640d7fe8f9fab7668d974
SHA512c2b9b619f608ec561a81fc5532a47d876f3a4b092babe8d2524c7055ba922f3d85ca9932698b692850d767884e0cdebce39838b5fea9cb6177645c5bb6867a6a
-
Filesize
720B
MD5c9cb558e70134be9aa37dd218aed3e4c
SHA178607d4b46bb9dba61c591c8b09591e281ca1731
SHA2565d4338c23d16ca91ac3918d853ed97e415191ecb708a5ccc5352867baaae06a7
SHA51260fc7047b11364c28cb75ea0ea333241490ca1b09d35ad70525339f30b1ac5394a9636f3efb5464531ceed165dae32cee3628b7eab3abddc95403c99ffedb7b7
-
Filesize
81KB
MD585b9df4b276647aa1170e21b5ce580a5
SHA1081d4d7f83660724cbe256401870d7a2310bda12
SHA2563b282419c0747296c11ea4ba8b92b775378fdb553e60900b61c8902864e7efeb
SHA512ab0d70323bc470f2620659fa9a790ff1bc21cbbca6a642880414bea303c53feaee8743526005d43ce136ce7812c4cd1f26a843bd9be822341f98d39dc37b20f5
-
Filesize
81KB
MD585b9df4b276647aa1170e21b5ce580a5
SHA1081d4d7f83660724cbe256401870d7a2310bda12
SHA2563b282419c0747296c11ea4ba8b92b775378fdb553e60900b61c8902864e7efeb
SHA512ab0d70323bc470f2620659fa9a790ff1bc21cbbca6a642880414bea303c53feaee8743526005d43ce136ce7812c4cd1f26a843bd9be822341f98d39dc37b20f5
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
148KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
148KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB