9645a116bf791e9fa1754ae3748618f8322c206f8f38dd67f60a8453ba8d1b33

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f9d2129dc38e756b31544c2415b6fef0.exe
Size

239KB
MD5

f9d2129dc38e756b31544c2415b6fef0
SHA1

f1a84c35490f76f4657c793105622dd341f65687
SHA256

9645a116bf791e9fa1754ae3748618f8322c206f8f38dd67f60a8453ba8d1b33
SHA512

12ab61057240da301910d479c52a276e49ddd39e13d428544dda11f54f82f6d04e65334c09d2965aba8f7f1d4479bd15c9e88fa9c1a7b7c565a653c57fb64de2
SSDEEP

6144:Apg4rIvq5V8RjeJ3UolYrllUwXd3XrJKdXYU7:ApgNvqV8NA3NyRdNnKYU7

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
1744	znwkgzk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\znwkgzk.exe	NEAS.f9d2129dc38e756b31544c2415b6fef0.exe
File created	C:\PROGRA~3\Mozilla\cskihnk.dll	znwkgzk.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2652	NEAS.f9d2129dc38e756b31544c2415b6fef0.exe
1744	znwkgzk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1744	2660	taskeng.exe	30
PID 2660 wrote to memory of 1744	2660	taskeng.exe	30
PID 2660 wrote to memory of 1744	2660	taskeng.exe	30
PID 2660 wrote to memory of 1744	2660	taskeng.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.f9d2129dc38e756b31544c2415b6fef0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f9d2129dc38e756b31544c2415b6fef0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2652

C:\Windows\system32\taskeng.exe
taskeng.exe {6930DEA2-EF20-4BCA-8D61-2FD06E51FF6D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\PROGRA~3\Mozilla\znwkgzk.exe
  C:\PROGRA~3\Mozilla\znwkgzk.exe -nfwatvg
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\znwkgzk.exe

Filesize
239KB

MD5
9cba68d6f2d163e8c52502e0884a2dbd

SHA1
431ca9a97d7076bafe841255259cb30135d33950

SHA256
41d51cc2ffa7719b99067e75d3cb209cc859591f9814eb20046065a97beb16dd

SHA512
d32b7e2505290aba2ca1fa1a1122b4fc21d5c52a60f931e96dab1ac256953ca5b8651d783cac84b2dc2682d8b0e21c6ffe5fea11cf4538e36c1720f66bf93876

Download Submit
C:\PROGRA~3\Mozilla\znwkgzk.exe

Filesize
239KB

MD5
9cba68d6f2d163e8c52502e0884a2dbd

SHA1
431ca9a97d7076bafe841255259cb30135d33950

SHA256
41d51cc2ffa7719b99067e75d3cb209cc859591f9814eb20046065a97beb16dd

SHA512
d32b7e2505290aba2ca1fa1a1122b4fc21d5c52a60f931e96dab1ac256953ca5b8651d783cac84b2dc2682d8b0e21c6ffe5fea11cf4538e36c1720f66bf93876

Download Submit
memory/1744-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1744-8-0x0000000000850000-0x00000000008AB000-memory.dmp

Filesize
364KB

Download
memory/1744-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1744-12-0x0000000000850000-0x00000000008AB000-memory.dmp

Filesize
364KB

Download
memory/2652-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2652-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2652-1-0x00000000002E0000-0x000000000033B000-memory.dmp

Filesize
364KB

Download
memory/2652-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2652-5-0x00000000002E0000-0x000000000033B000-memory.dmp

Filesize
364KB

Download