Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

NEAS.c60c5...a0.exe

windows7-x64

7

NEAS.c60c5...a0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 20:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe

  • Size

    7.9MB

  • MD5

    c60c5dffa371c7e41fff7d8388a95da0

  • SHA1

    791029587b7a998634adcbc6e3a5c7e37fe66adb

  • SHA256

    9b0ad3f2b8a78a14542a531b7618caf357c67653edf964fc21b0987b95dc3470

  • SHA512

    7b185b5ee3ff5856f0221240dbd4c1e5e2e07d22d3e92491adb2e30ab03c6e13daf4c7b907cfdacb21bbf7345a3e3e38ed81e797dd280c4ca72c651fbc64e531

  • SSDEEP

    196608:1AaIis50mr2puHUHNTVxbAQAtwq+ZkiKDIjx0vjXAQYj+b:LsKmr2pu0tTVxAaq+ZkF0x0TAr

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 10 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe"
      2⤵
      • Loads dropped DLL
      PID:4468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\VCRUNTIME140.dll
    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\VCRUNTIME140.dll
    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_bz2.pyd
    Filesize

    81KB

    MD5

    56203038756826a0a683d5750ee04093

    SHA1

    93d5a07f49bdcc7eb8fba458b2428fe4afcc20d2

    SHA256

    31c2f21adf27ca77fa746c0fda9c7d7734587ab123b95f2310725aaf4bf4ff3c

    SHA512

    3da5ae98511300694c9e91617c152805761d3de567981b5ab3ef7cd3dbba3521aae0d49b1eb42123d241b5ed13e8637d5c5bc1b44b9eaa754657f30662159f3a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_cffi_backend.cp310-win_amd64.pyd
    Filesize

    177KB

    MD5

    ebb660902937073ec9695ce08900b13d

    SHA1

    881537acead160e63fe6ba8f2316a2fbbb5cb311

    SHA256

    52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

    SHA512

    19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_cffi_backend.cp310-win_amd64.pyd
    Filesize

    177KB

    MD5

    ebb660902937073ec9695ce08900b13d

    SHA1

    881537acead160e63fe6ba8f2316a2fbbb5cb311

    SHA256

    52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

    SHA512

    19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_decimal.pyd
    Filesize

    246KB

    MD5

    709613d7d7bc30abdaee015c331664b6

    SHA1

    84278fd8acc53c50b4e2ffa3f47b9ddad7dd7a70

    SHA256

    8600cae4f34cc64c406198e19539d0d4f5a574fc60b32b8aa8f32fd64c981da5

    SHA512

    4eb48bbcdf7cd9ebb9909e5269d4663bf14906a282a1f1418cc7e137f2be1c792019d78446d4d8bea63024cbf01bec14e28633d6e4ebbd85d7d074b948cab211

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_hashlib.pyd
    Filesize

    63KB

    MD5

    7a74284813386818ada7bf55c8d8acf9

    SHA1

    380c4184eec7ca266e4c2b96bb92a504dfd8fe5f

    SHA256

    21a1819013de423bb3b9b682d0b3506c6ef57ee88c61edf4ba12d8d5f589c9c2

    SHA512

    f8bc4ac57ada754006bbbb0bfa1ccb6c659f9c4d3270970e26219005e872b60afb9242457d8eb3eae0ce1f608f730da3bf16715f04b47bea4c95519dd9994a46

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_hashlib.pyd
    Filesize

    63KB

    MD5

    7a74284813386818ada7bf55c8d8acf9

    SHA1

    380c4184eec7ca266e4c2b96bb92a504dfd8fe5f

    SHA256

    21a1819013de423bb3b9b682d0b3506c6ef57ee88c61edf4ba12d8d5f589c9c2

    SHA512

    f8bc4ac57ada754006bbbb0bfa1ccb6c659f9c4d3270970e26219005e872b60afb9242457d8eb3eae0ce1f608f730da3bf16715f04b47bea4c95519dd9994a46

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_lzma.pyd
    Filesize

    154KB

    MD5

    14ea9d8ba0c2379fb1a9f6f3e9bbd63b

    SHA1

    f7d4e7b86acaf796679d173e18f758c1e338de82

    SHA256

    c414a5a418c41a7a8316687047ed816cad576741bd09a268928e381a03e1eb39

    SHA512

    64a52fe41007a1cac4afedf2961727b823d7f1c4399d3465d22377b5a4a5935cee2598447aeff62f99c4e98bb3657cfae25b5c27de32107a3a829df5a25ba1ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_socket.pyd
    Filesize

    77KB

    MD5

    c389430e19f1cd4c2e7b8538e8c52459

    SHA1

    546ed5a85ad80a7b7db99f80c7080dc972e4f2a2

    SHA256

    a14efa68d8f7ec018fb867a6ba6c6c290a803b4001fd8c45db7bda66fb700067

    SHA512

    5bef6c90c65bf1d4be0ce0d0cb3f38fe288f5716c93e444cf12f89f066791850d8316d414f1d795ff148c9e841cda90ef9c35ceb4a499563f28d068a6b427671

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\_socket.pyd
    Filesize

    77KB

    MD5

    c389430e19f1cd4c2e7b8538e8c52459

    SHA1

    546ed5a85ad80a7b7db99f80c7080dc972e4f2a2

    SHA256

    a14efa68d8f7ec018fb867a6ba6c6c290a803b4001fd8c45db7bda66fb700067

    SHA512

    5bef6c90c65bf1d4be0ce0d0cb3f38fe288f5716c93e444cf12f89f066791850d8316d414f1d795ff148c9e841cda90ef9c35ceb4a499563f28d068a6b427671

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\base_library.zip
    Filesize

    859KB

    MD5

    ee10cdd5d13a677455fb67c91a25d33c

    SHA1

    bc8434d1b1d1effa99cb8c6b79e2e83f619db077

    SHA256

    5bf65772a44b7888ced0f9f2977ea8962f7168c30a0ea31e858dbdc0874dd188

    SHA512

    c58f1beabe25dffeed33ee4465b0f05e9961fa6937fc3368a18c54a090ebb86456cc15b9d11b81dfbb16d404ca0979e643f647a21a3e587dd747b07004284a69

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\cryptography\hazmat\bindings\_rust.pyd
    Filesize

    6.3MB

    MD5

    0617be8f80712bfecc5b6551b0611c54

    SHA1

    8211673695be21afb30abde8f63e6321b4e2a492

    SHA256

    dcb9980557fd18e59a075758236da0d3fcd445fae2ef990e670cc5da1a67fc73

    SHA512

    2343786e5d40771d688fe5582dca2240b8821c957f51eb7cfb63a679bd5d71a126fee2bcd5e91feb205117a49220610daf302c95e245c34a0a8c6e061262c31a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\cryptography\hazmat\bindings\_rust.pyd
    Filesize

    6.3MB

    MD5

    0617be8f80712bfecc5b6551b0611c54

    SHA1

    8211673695be21afb30abde8f63e6321b4e2a492

    SHA256

    dcb9980557fd18e59a075758236da0d3fcd445fae2ef990e670cc5da1a67fc73

    SHA512

    2343786e5d40771d688fe5582dca2240b8821c957f51eb7cfb63a679bd5d71a126fee2bcd5e91feb205117a49220610daf302c95e245c34a0a8c6e061262c31a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\libcrypto-1_1.dll
    Filesize

    3.3MB

    MD5

    80b72c24c74d59ae32ba2b0ea5e7dad2

    SHA1

    75f892e361619e51578b312605201571bfb67ff8

    SHA256

    eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d

    SHA512

    08014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\libcrypto-1_1.dll
    Filesize

    3.3MB

    MD5

    80b72c24c74d59ae32ba2b0ea5e7dad2

    SHA1

    75f892e361619e51578b312605201571bfb67ff8

    SHA256

    eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d

    SHA512

    08014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\python3.dll
    Filesize

    64KB

    MD5

    24f4d5a96cd4110744766ea2da1b8ffa

    SHA1

    b12a2205d3f70f5c636418811ab2f8431247da15

    SHA256

    73b0f3952be222ce676672603ae3848ee6e8e479782bd06745116712a4834c53

    SHA512

    bd2f27441fe5c25c30bab22c967ef32306bcea2f6be6f4a5da8bbb5b54d3d5f59da1ffcb55172d2413fe0235dd7702d734654956e142e9a0810160b8c16225f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\python3.dll
    Filesize

    64KB

    MD5

    24f4d5a96cd4110744766ea2da1b8ffa

    SHA1

    b12a2205d3f70f5c636418811ab2f8431247da15

    SHA256

    73b0f3952be222ce676672603ae3848ee6e8e479782bd06745116712a4834c53

    SHA512

    bd2f27441fe5c25c30bab22c967ef32306bcea2f6be6f4a5da8bbb5b54d3d5f59da1ffcb55172d2413fe0235dd7702d734654956e142e9a0810160b8c16225f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\python3.dll
    Filesize

    64KB

    MD5

    24f4d5a96cd4110744766ea2da1b8ffa

    SHA1

    b12a2205d3f70f5c636418811ab2f8431247da15

    SHA256

    73b0f3952be222ce676672603ae3848ee6e8e479782bd06745116712a4834c53

    SHA512

    bd2f27441fe5c25c30bab22c967ef32306bcea2f6be6f4a5da8bbb5b54d3d5f59da1ffcb55172d2413fe0235dd7702d734654956e142e9a0810160b8c16225f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\python310.dll
    Filesize

    4.3MB

    MD5

    e4533934b37e688106beac6c5919281e

    SHA1

    ada39f10ef0bbdcf05822f4260e43d53367b0017

    SHA256

    2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

    SHA512

    fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\python310.dll
    Filesize

    4.3MB

    MD5

    e4533934b37e688106beac6c5919281e

    SHA1

    ada39f10ef0bbdcf05822f4260e43d53367b0017

    SHA256

    2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

    SHA512

    fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\select.pyd
    Filesize

    29KB

    MD5

    c6ef07e75eae2c147042d142e23d2173

    SHA1

    6ef3e912db5faf5a6b4225dbb6e34337a2271a60

    SHA256

    43ee736c8a93e28b1407bf5e057a7449f16ee665a6e51a0f1bc416e13cee7e78

    SHA512

    30e915566e7b934bdd49e708151c98f732ff338d7bc3a46797de9cca308621791276ea03372c5e2834b6b55e66e05d58cf1bb4cb9ff31fb0a1c1aca0fcdc0d45

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\select.pyd
    Filesize

    29KB

    MD5

    c6ef07e75eae2c147042d142e23d2173

    SHA1

    6ef3e912db5faf5a6b4225dbb6e34337a2271a60

    SHA256

    43ee736c8a93e28b1407bf5e057a7449f16ee665a6e51a0f1bc416e13cee7e78

    SHA512

    30e915566e7b934bdd49e708151c98f732ff338d7bc3a46797de9cca308621791276ea03372c5e2834b6b55e66e05d58cf1bb4cb9ff31fb0a1c1aca0fcdc0d45

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI20242\unicodedata.pyd
    Filesize

    1.1MB

    MD5

    d4964a28a22078c30064c65e968f9e1f

    SHA1

    b9b95975bea97a55c888da66148d54bdb38b609b

    SHA256

    b204718d21952369726472ca12712047839119ccf87e16979af595c0a57b6703

    SHA512

    bfe200b255ae1ddba53d98d54479e7e1d0932fb27bbfdcb4170d3d4cbbbfc297e3b5fd273b830399b795feb64cd0d9c48d0e1e0eaf72d0e0992261864e2d7296

    Download Submit