ab729b9c671d2042d82c5461bb9b79676dbab0bdabbf241098ffa55e014594f3

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.74e66212a35b398290b2fcb48b79b070.exe
Size

482KB
MD5

74e66212a35b398290b2fcb48b79b070
SHA1

d7f7821d6bce7af62f96916c0bc45b21f5988587
SHA256

ab729b9c671d2042d82c5461bb9b79676dbab0bdabbf241098ffa55e014594f3
SHA512

56380eb65197885930ae38d08dadae5d825fb9fc032afa074f17d8c0b6745c50cda9c844e515f58a312d17423407f9fe3b086d2626f299fae4f6e73e1affeb74
SSDEEP

12288:QWlc87eqqV5e+wBV6O+/UdMu+hDWiXGzAsz+KMlpd:QWSqqHeVBxr+hEAsz+KMlpd

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1980	calcetsh.exe
2068	~319B.tmp
2760	Comphost.exe

Loads dropped DLL 3 IoCs

pid	Process
2180	NEAS.74e66212a35b398290b2fcb48b79b070.exe
2180	NEAS.74e66212a35b398290b2fcb48b79b070.exe
1980	calcetsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Comphost = "C:\\Users\\Admin\\AppData\\Roaming\\cttudiag\\calcetsh.exe"	NEAS.74e66212a35b398290b2fcb48b79b070.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Comphost.exe	NEAS.74e66212a35b398290b2fcb48b79b070.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1980	calcetsh.exe
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1204	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	calcetsh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1980	2180	NEAS.74e66212a35b398290b2fcb48b79b070.exe	29
PID 2180 wrote to memory of 1980	2180	NEAS.74e66212a35b398290b2fcb48b79b070.exe	29
PID 2180 wrote to memory of 1980	2180	NEAS.74e66212a35b398290b2fcb48b79b070.exe	29
PID 2180 wrote to memory of 1980	2180	NEAS.74e66212a35b398290b2fcb48b79b070.exe	29
PID 1980 wrote to memory of 2068	1980	calcetsh.exe	30
PID 1980 wrote to memory of 2068	1980	calcetsh.exe	30
PID 1980 wrote to memory of 2068	1980	calcetsh.exe	30
PID 1980 wrote to memory of 2068	1980	calcetsh.exe	30
PID 2068 wrote to memory of 1204	2068	~319B.tmp	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1204
- C:\Users\Admin\AppData\Local\Temp\NEAS.74e66212a35b398290b2fcb48b79b070.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.74e66212a35b398290b2fcb48b79b070.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Roaming\cttudiag\calcetsh.exe
    "C:\Users\Admin\AppData\Roaming\cttudiag"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\~319B.tmp
      1204 494088 1980 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2068

C:\Windows\SysWOW64\Comphost.exe
C:\Windows\SysWOW64\Comphost.exe -s
1⤵
- Executes dropped EXE
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~319B.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
C:\Users\Admin\AppData\Roaming\cttudiag\calcetsh.exe

Filesize
482KB

MD5
27f3dae9d99d8d7b3f4b9f3d11802dbc

SHA1
9f3a5a595b2b8f63538e0b5e66273bbaa17514e4

SHA256
878473903761d59881583dfcfaf83f9c98e16a0ba19adba41797e2cd434bffd0

SHA512
31f01559248eea73506114997473e9143527c85c1cc7019318b8b50748eeb2c48dfae4dc3e10a2b6ddb013c94a695d5518c908bf3579220fbec9ad315ad21019

Download Submit
C:\Users\Admin\AppData\Roaming\cttudiag\calcetsh.exe

Filesize
482KB

MD5
27f3dae9d99d8d7b3f4b9f3d11802dbc

SHA1
9f3a5a595b2b8f63538e0b5e66273bbaa17514e4

SHA256
878473903761d59881583dfcfaf83f9c98e16a0ba19adba41797e2cd434bffd0

SHA512
31f01559248eea73506114997473e9143527c85c1cc7019318b8b50748eeb2c48dfae4dc3e10a2b6ddb013c94a695d5518c908bf3579220fbec9ad315ad21019

Download Submit
C:\Users\Admin\AppData\Roaming\cttudiag\calcetsh.exe

Filesize
482KB

MD5
27f3dae9d99d8d7b3f4b9f3d11802dbc

SHA1
9f3a5a595b2b8f63538e0b5e66273bbaa17514e4

SHA256
878473903761d59881583dfcfaf83f9c98e16a0ba19adba41797e2cd434bffd0

SHA512
31f01559248eea73506114997473e9143527c85c1cc7019318b8b50748eeb2c48dfae4dc3e10a2b6ddb013c94a695d5518c908bf3579220fbec9ad315ad21019

Download Submit
C:\Windows\SysWOW64\Comphost.exe

Filesize
482KB

MD5
27f3dae9d99d8d7b3f4b9f3d11802dbc

SHA1
9f3a5a595b2b8f63538e0b5e66273bbaa17514e4

SHA256
878473903761d59881583dfcfaf83f9c98e16a0ba19adba41797e2cd434bffd0

SHA512
31f01559248eea73506114997473e9143527c85c1cc7019318b8b50748eeb2c48dfae4dc3e10a2b6ddb013c94a695d5518c908bf3579220fbec9ad315ad21019

Download Submit
C:\Windows\SysWOW64\Comphost.exe

Filesize
482KB

MD5
27f3dae9d99d8d7b3f4b9f3d11802dbc

SHA1
9f3a5a595b2b8f63538e0b5e66273bbaa17514e4

SHA256
878473903761d59881583dfcfaf83f9c98e16a0ba19adba41797e2cd434bffd0

SHA512
31f01559248eea73506114997473e9143527c85c1cc7019318b8b50748eeb2c48dfae4dc3e10a2b6ddb013c94a695d5518c908bf3579220fbec9ad315ad21019

Download Submit
\Users\Admin\AppData\Local\Temp\~319B.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
\Users\Admin\AppData\Roaming\cttudiag\calcetsh.exe

Filesize
482KB

MD5
27f3dae9d99d8d7b3f4b9f3d11802dbc

SHA1
9f3a5a595b2b8f63538e0b5e66273bbaa17514e4

SHA256
878473903761d59881583dfcfaf83f9c98e16a0ba19adba41797e2cd434bffd0

SHA512
31f01559248eea73506114997473e9143527c85c1cc7019318b8b50748eeb2c48dfae4dc3e10a2b6ddb013c94a695d5518c908bf3579220fbec9ad315ad21019

Download Submit
\Users\Admin\AppData\Roaming\cttudiag\calcetsh.exe

Filesize
482KB

MD5
27f3dae9d99d8d7b3f4b9f3d11802dbc

SHA1
9f3a5a595b2b8f63538e0b5e66273bbaa17514e4

SHA256
878473903761d59881583dfcfaf83f9c98e16a0ba19adba41797e2cd434bffd0

SHA512
31f01559248eea73506114997473e9143527c85c1cc7019318b8b50748eeb2c48dfae4dc3e10a2b6ddb013c94a695d5518c908bf3579220fbec9ad315ad21019

Download Submit
memory/1204-27-0x0000000002A40000-0x0000000002A4D000-memory.dmp

Filesize
52KB

Download
memory/1204-37-0x000007FEF6E40000-0x000007FEF6F83000-memory.dmp

Filesize
1.3MB

Download
memory/1204-18-0x0000000003CB0000-0x0000000003D38000-memory.dmp

Filesize
544KB

Download
memory/1204-36-0x000007FF6A3B0000-0x000007FF6A3BA000-memory.dmp

Filesize
40KB

Download
memory/1204-35-0x000007FEF6E40000-0x000007FEF6F83000-memory.dmp

Filesize
1.3MB

Download
memory/1204-22-0x0000000003CB0000-0x0000000003D38000-memory.dmp

Filesize
544KB

Download
memory/1204-25-0x0000000002A30000-0x0000000002A36000-memory.dmp

Filesize
24KB

Download
memory/1204-21-0x0000000003CB0000-0x0000000003D38000-memory.dmp

Filesize
544KB

Download
memory/1980-20-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download
memory/1980-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1980-19-0x0000000000320000-0x00000000003A1000-memory.dmp

Filesize
516KB

Download
memory/2180-5-0x0000000001C80000-0x0000000001D03000-memory.dmp

Filesize
524KB

Download
memory/2180-1-0x0000000000490000-0x0000000000511000-memory.dmp

Filesize
516KB

Download
memory/2180-34-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2180-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2760-33-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download