Overview

overview

9

Static

static

3

NEAS.b284f...e0.exe

windows7-x64

9

NEAS.b284f...e0.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.b284f811c7e6d2540646307dd32aece0.exe

  • Size

    560KB

  • Sample

    231013-zdefvagc23

  • MD5

    b284f811c7e6d2540646307dd32aece0

  • SHA1

    46a6a84de4f59d8b224bcc876def87dcc683753a

  • SHA256

    c57d4cea3c57ba4cfa683bc88762f0945e49fb08549d95db2a56591ec7f873f0

  • SHA512

    f4e3feff083092bb13f5d9513612231c6cb90de08f91516d66157734176417476d4549b0495b3edbf163d04e1881cd964ab99e6b947d7471d6f040f11788c8c2

  • SSDEEP

    12288:tyos0ymOcB+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2d:tps0LOsDFncLmKDZOSz1FO50

Score
9/10
discoveryransomware

Malware Config

Targets

    • Target

      NEAS.b284f811c7e6d2540646307dd32aece0.exe

    • Size

      560KB

    • MD5

      b284f811c7e6d2540646307dd32aece0

    • SHA1

      46a6a84de4f59d8b224bcc876def87dcc683753a

    • SHA256

      c57d4cea3c57ba4cfa683bc88762f0945e49fb08549d95db2a56591ec7f873f0

    • SHA512

      f4e3feff083092bb13f5d9513612231c6cb90de08f91516d66157734176417476d4549b0495b3edbf163d04e1881cd964ab99e6b947d7471d6f040f11788c8c2

    • SSDEEP

      12288:tyos0ymOcB+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2d:tps0LOsDFncLmKDZOSz1FO50

    Score
    9/10
    discoveryransomware

    • Renames multiple (195) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks