362c3f08658bbd5afb648d8e867d4696577ee9789e4c5d841a0a3df811227c24

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.083681585ef25f0503e2d57838628c80_JC.exe
Size

315KB
MD5

083681585ef25f0503e2d57838628c80
SHA1

b6e3415682f83018d667f0760f8d7cbddd1a18a2
SHA256

362c3f08658bbd5afb648d8e867d4696577ee9789e4c5d841a0a3df811227c24
SHA512

f10ae5e681c796d60f1e21bb265bf5c9f73beb7c10b8a20e29f198776dac0259e343058b1660d352486fb938d916b5f022df35359fa33ad35adcfbcb53aaa29d
SSDEEP

6144:CDJVazMKV31FdaQvXluxqU+A/0y+nt75voqQEnHv0CxN8H9RJPz7Dha:CDJM/bXntAh+nhZoqQEHvVIzJPzk

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
5024	xxmjpmn.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\yscklod.dll	xxmjpmn.exe
File created	C:\PROGRA~3\Mozilla\xxmjpmn.exe	NEAS.083681585ef25f0503e2d57838628c80_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.083681585ef25f0503e2d57838628c80_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.083681585ef25f0503e2d57838628c80_JC.exe"
1⤵
- Drops file in Program Files directory
PID:2700

C:\PROGRA~3\Mozilla\xxmjpmn.exe
C:\PROGRA~3\Mozilla\xxmjpmn.exe -nznotnb
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\xxmjpmn.exe

Filesize
315KB

MD5
8d7096798b3983d2eafef7cde0131f95

SHA1
6f1c29c51e2e3fc4bef0ae45dd0d5365d729ebaa

SHA256
d7664833a8d3d8e69fc461d3012a9662d43cbc6cbace9fef5e946577bd840591

SHA512
200d05e9c80eea0c3fd21050ea547c7d394c08e7d866eda0476d213f772ae1cd95189ab9c0d5cda713ee80b339c2f8ae7ec62d82cccfbf219b1be25d76caf034

Download Submit
C:\ProgramData\Mozilla\xxmjpmn.exe

Filesize
315KB

MD5
8d7096798b3983d2eafef7cde0131f95

SHA1
6f1c29c51e2e3fc4bef0ae45dd0d5365d729ebaa

SHA256
d7664833a8d3d8e69fc461d3012a9662d43cbc6cbace9fef5e946577bd840591

SHA512
200d05e9c80eea0c3fd21050ea547c7d394c08e7d866eda0476d213f772ae1cd95189ab9c0d5cda713ee80b339c2f8ae7ec62d82cccfbf219b1be25d76caf034

Download Submit
memory/2700-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2700-1-0x00000000009F0000-0x0000000000A4B000-memory.dmp

Filesize
364KB

Download
memory/2700-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5024-9-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5024-11-0x00000000008F0000-0x000000000094B000-memory.dmp

Filesize
364KB

Download
memory/5024-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download