Overview

overview

8

Static

static

3

NEAS.45cb2...b0.exe

windows7-x64

8

NEAS.45cb2...b0.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.45cb27d06b9376380492b77fd8ee09b0.exe

  • Size

    160KB

  • Sample

    231014-wgbmksbf63

  • MD5

    45cb27d06b9376380492b77fd8ee09b0

  • SHA1

    a2a83ddb748012716abd8b4a6549255f55699c5d

  • SHA256

    2cf2e7ec166d7ac3cf27f56c11e9c29003048ec5328668f7f3415254786f2c8b

  • SHA512

    e338c45d37d101c5d39ecc759d4d601b3fe43692412ddf0439c031715faeb210780e767c780aa20cc4192787ec323d5101ecac7e27f211d629078d547a8c3ad9

  • SSDEEP

    3072:tq4e7qiyqBpKlsl/EuaeTWzSfWERN0kEy:thfqB0lsGuaexWE7

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      NEAS.45cb27d06b9376380492b77fd8ee09b0.exe

    • Size

      160KB

    • MD5

      45cb27d06b9376380492b77fd8ee09b0

    • SHA1

      a2a83ddb748012716abd8b4a6549255f55699c5d

    • SHA256

      2cf2e7ec166d7ac3cf27f56c11e9c29003048ec5328668f7f3415254786f2c8b

    • SHA512

      e338c45d37d101c5d39ecc759d4d601b3fe43692412ddf0439c031715faeb210780e767c780aa20cc4192787ec323d5101ecac7e27f211d629078d547a8c3ad9

    • SSDEEP

      3072:tq4e7qiyqBpKlsl/EuaeTWzSfWERN0kEy:thfqB0lsGuaexWE7

    Score
    8/10
    evasionpersistence

    • Blocklisted process makes network request

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks