Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
14-10-2023 17:59
General
-
Target
NEAS.74e66212a35b398290b2fcb48b79b070.exe
-
Size
482KB
-
MD5
74e66212a35b398290b2fcb48b79b070
-
SHA1
d7f7821d6bce7af62f96916c0bc45b21f5988587
-
SHA256
ab729b9c671d2042d82c5461bb9b79676dbab0bdabbf241098ffa55e014594f3
-
SHA512
56380eb65197885930ae38d08dadae5d825fb9fc032afa074f17d8c0b6745c50cda9c844e515f58a312d17423407f9fe3b086d2626f299fae4f6e73e1affeb74
-
SSDEEP
12288:QWlc87eqqV5e+wBV6O+/UdMu+hDWiXGzAsz+KMlpd:QWSqqHeVBxr+hEAsz+KMlpd
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.74e66212a35b398290b2fcb48b79b070.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.74e66212a35b398290b2fcb48b79b070.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cmdconv\edpnlder.exe"C:\Users\Admin\AppData\Roaming\cmdconv"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~827E.tmp3244 494088 1148 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\RdpSpugc.exeC:\Windows\SysWOW64\RdpSpugc.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
482KB
MD525ed6ffc7e46e96dcbd589bd7f4da653
SHA1ff92315a24d1a8d89e4ef33282239b35369621f0
SHA256c87cf132ad9332d36ee305d808c180f0bf23ad6adb1d7812d903086a1ff78e6d
SHA5122e2e6aa07a6a6d92ac7fc247f4461155e48ff59f5a1fe71f25eed048ccf0d5e1ee24cbb72146d9dc9305b4dc728054fd74d51681abf00fc120b5620dc6e0331a
-
Filesize
482KB
MD525ed6ffc7e46e96dcbd589bd7f4da653
SHA1ff92315a24d1a8d89e4ef33282239b35369621f0
SHA256c87cf132ad9332d36ee305d808c180f0bf23ad6adb1d7812d903086a1ff78e6d
SHA5122e2e6aa07a6a6d92ac7fc247f4461155e48ff59f5a1fe71f25eed048ccf0d5e1ee24cbb72146d9dc9305b4dc728054fd74d51681abf00fc120b5620dc6e0331a
-
Filesize
482KB
MD525ed6ffc7e46e96dcbd589bd7f4da653
SHA1ff92315a24d1a8d89e4ef33282239b35369621f0
SHA256c87cf132ad9332d36ee305d808c180f0bf23ad6adb1d7812d903086a1ff78e6d
SHA5122e2e6aa07a6a6d92ac7fc247f4461155e48ff59f5a1fe71f25eed048ccf0d5e1ee24cbb72146d9dc9305b4dc728054fd74d51681abf00fc120b5620dc6e0331a
-
Filesize
482KB
MD525ed6ffc7e46e96dcbd589bd7f4da653
SHA1ff92315a24d1a8d89e4ef33282239b35369621f0
SHA256c87cf132ad9332d36ee305d808c180f0bf23ad6adb1d7812d903086a1ff78e6d
SHA5122e2e6aa07a6a6d92ac7fc247f4461155e48ff59f5a1fe71f25eed048ccf0d5e1ee24cbb72146d9dc9305b4dc728054fd74d51681abf00fc120b5620dc6e0331a
-
Filesize
516KB
-
Filesize
20KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
516KB
-
Filesize
24KB
-
Filesize
544KB
-
Filesize
544KB
-
Filesize
52KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
524KB
-
Filesize
524KB