ddd9acbbd9d512465dd6ac713e2854fb86d6a7e0ed960329c60ad19f95700ed9

Analysis

max time kernel
144s
max time network
154s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.5600e1590b02a3644951db7fb76a3bf0.exe
Size

83KB
MD5

5600e1590b02a3644951db7fb76a3bf0
SHA1

ae0a09bccae8bc5f8bf489c2236025eaf57baab9
SHA256

ddd9acbbd9d512465dd6ac713e2854fb86d6a7e0ed960329c60ad19f95700ed9
SHA512

355acb9575582facc3d20d7adbe719797284d2dd482ade04e74da91ff39c220af8c211ee090177766de6902041ace57d61a05582de81fa0106c9ff762d4225df
SSDEEP

1536:oKvZe3T6OrWW8ExT+3hP7SgtriHPv4VKjnqHrlojrD0LM9:oKvmxCaTiPWiiHPzaYDP9

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1732-2-0x0000000010410000-0x0000000010446000-memory.dmp	upx
behavioral1/memory/1732-5-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fghdfghdfgh\ggggg.exe	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\fghdfghdfgh\ggggg.exe	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe
1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe
Token: SeDebugPrivilege	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe
Token: SeDebugPrivilege	2684	iexplore.exe
Token: SeDebugPrivilege	2684	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28
PID 1732 wrote to memory of 2684	1732	NEAS.5600e1590b02a3644951db7fb76a3bf0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.5600e1590b02a3644951db7fb76a3bf0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5600e1590b02a3644951db7fb76a3bf0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1732-2-0x0000000010410000-0x0000000010446000-memory.dmp

Filesize
216KB

Download
memory/1732-5-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download