Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 17:51
Behavioral task
behavioral1
Sample
NEAS.3aa0935d6942e0f17c10b72dad45e340.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.3aa0935d6942e0f17c10b72dad45e340.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
NEAS.3aa0935d6942e0f17c10b72dad45e340.exe
-
Size
73KB
-
MD5
3aa0935d6942e0f17c10b72dad45e340
-
SHA1
08a5139eb0668ae753efd68144d24ef9308214b2
-
SHA256
808e7d8c09d8cb3e6a6907d05b76de82deda7e87e8d8e1e3b3cf0b7425e302f6
-
SHA512
ab6c48abaa6be1af53d399c7f2160fb5a9b6a8ee41b93194eaad16a195bb41a9d793b6a043aac105c05dd64dedf5195acad223483db749486c4d762f7c1337cc
-
SSDEEP
1536:N555555555555pmgSeGDjtQhnwmmB0y6MqqU+2bbbAV2/S2mr3IdE8mne0Avu5r+:qMSjOnrmByMqqDL2/mr3IdE8we0Avu5h
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qmmuaslduxr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.3aa0935d6942e0f17c10b72dad45e340.exe" NEAS.3aa0935d6942e0f17c10b72dad45e340.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\E: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\H: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\K: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\P: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\U: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\V: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\I: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\O: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\T: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\W: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\A: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\B: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\R: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\S: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\X: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\G: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\J: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\L: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\M: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\N: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\Q: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe File opened (read-only) \??\Z: NEAS.3aa0935d6942e0f17c10b72dad45e340.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString NEAS.3aa0935d6942e0f17c10b72dad45e340.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier NEAS.3aa0935d6942e0f17c10b72dad45e340.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4176 wrote to memory of 1352 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 87 PID 4176 wrote to memory of 1352 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 87 PID 4176 wrote to memory of 1352 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 87 PID 4176 wrote to memory of 4900 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 95 PID 4176 wrote to memory of 4900 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 95 PID 4176 wrote to memory of 4900 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 95 PID 4176 wrote to memory of 1880 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 102 PID 4176 wrote to memory of 1880 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 102 PID 4176 wrote to memory of 1880 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 102 PID 4176 wrote to memory of 4736 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 105 PID 4176 wrote to memory of 4736 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 105 PID 4176 wrote to memory of 4736 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 105 PID 4176 wrote to memory of 948 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 107 PID 4176 wrote to memory of 948 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 107 PID 4176 wrote to memory of 948 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 107 PID 4176 wrote to memory of 4404 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 109 PID 4176 wrote to memory of 4404 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 109 PID 4176 wrote to memory of 4404 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 109 PID 4176 wrote to memory of 236 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 112 PID 4176 wrote to memory of 236 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 112 PID 4176 wrote to memory of 236 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 112 PID 4176 wrote to memory of 2168 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 114 PID 4176 wrote to memory of 2168 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 114 PID 4176 wrote to memory of 2168 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 114 PID 4176 wrote to memory of 4384 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 116 PID 4176 wrote to memory of 4384 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 116 PID 4176 wrote to memory of 4384 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 116 PID 4176 wrote to memory of 8 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 119 PID 4176 wrote to memory of 8 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 119 PID 4176 wrote to memory of 8 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 119 PID 4176 wrote to memory of 1524 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 128 PID 4176 wrote to memory of 1524 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 128 PID 4176 wrote to memory of 1524 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 128 PID 4176 wrote to memory of 4860 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 130 PID 4176 wrote to memory of 4860 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 130 PID 4176 wrote to memory of 4860 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 130 PID 4176 wrote to memory of 1096 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 132 PID 4176 wrote to memory of 1096 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 132 PID 4176 wrote to memory of 1096 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 132 PID 4176 wrote to memory of 4004 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 135 PID 4176 wrote to memory of 4004 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 135 PID 4176 wrote to memory of 4004 4176 NEAS.3aa0935d6942e0f17c10b72dad45e340.exe 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3aa0935d6942e0f17c10b72dad45e340.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3aa0935d6942e0f17c10b72dad45e340.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1352
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:4900
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1880
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4736
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:948
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4404
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:236
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2168
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4384
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:8
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:1524
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4860
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1096
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:4004
-