2551c2cef3156079440012ce352b108a2399aea5c5e98c8da1d9d098b6a0b1c7

Analysis

max time kernel
151s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.bcf0a62b0272ea032ecebee668e205e0.exe
Size

410KB
MD5

bcf0a62b0272ea032ecebee668e205e0
SHA1

4f3afe603745625e22182ab6f0f97b90c5114a02
SHA256

2551c2cef3156079440012ce352b108a2399aea5c5e98c8da1d9d098b6a0b1c7
SHA512

48caccefe0670f9120da889f1388345ce7ac3041c518b59c770cd6e7ec37f5447a8e39f65920a79083122d355848eb8d2ea4c4a66aeac605d9a873d4dd3b1665
SSDEEP

12288:CxIK9V14ImyHY5AI336k9Xy+bwoYCeySJjBz1gxj:CJEyYH3jp/d7ezjBz1gxj

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	gmhrfo.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\gmhrfo.exe"	gmhrfo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2696	1336	NEAS.bcf0a62b0272ea032ecebee668e205e0.exe	92
PID 1336 wrote to memory of 2696	1336	NEAS.bcf0a62b0272ea032ecebee668e205e0.exe	92
PID 1336 wrote to memory of 2696	1336	NEAS.bcf0a62b0272ea032ecebee668e205e0.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.bcf0a62b0272ea032ecebee668e205e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.bcf0a62b0272ea032ecebee668e205e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\ProgramData\gmhrfo.exe
  "C:\ProgramData\gmhrfo.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DumpStack.log.tmp .exe

Filesize
410KB

MD5
a925b9c0ec35cfe25877ddcd1ed2b137

SHA1
6f644fec2a6342363f396d36d85ea40e805bed77

SHA256
bd6d38cf8449ad79f7e7dad6a487138b010744b68c7b9ee6a9d80eadb923cd71

SHA512
2ff98712038dac7b98ac919896c0f577e715e4bbddb2f918b46f418998b58098e6a997ade95277220e24f4e1198dbfae9d158e0cf486d50f4b30bc718cb92b5f

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
150KB

MD5
a52d6cb53c4c31e9f5ad53a356adf9dd

SHA1
4e9b2d208dc3c3a6e23decb0a7d7381c73f7b101

SHA256
f6bc441488529eadccfef115d11fa10c5cb8cb125b6c08c52a2bbc144bd4f7d8

SHA512
6d86153ffb8c803092d4fe30f1df1371657023eb10fd56dfeca684ff13a3222f64b11592576d3990f14cf915987a3372cf89774f811ef33dbd5f1b7db5ba681b

Download Submit
C:\ProgramData\gmhrfo.exe

Filesize
260KB

MD5
322dec6f2e7bd61a8fa9d767802e6d00

SHA1
11f9681f2340c7171241f9877b68f2fbe99851fb

SHA256
8fc105815f91e048ac1b0a0e6edc6b155d137e75451e6d8ccbb272530c107d6b

SHA512
a45a130ec7ebd626e08ab4c738112f89dd7c9f0cbede421780a96c79a0645d118d907280234fea4010ac96ea35f53759f0766b135c10d578aefe6f6b55ec6d33

Download Submit
C:\ProgramData\gmhrfo.exe

Filesize
260KB

MD5
322dec6f2e7bd61a8fa9d767802e6d00

SHA1
11f9681f2340c7171241f9877b68f2fbe99851fb

SHA256
8fc105815f91e048ac1b0a0e6edc6b155d137e75451e6d8ccbb272530c107d6b

SHA512
a45a130ec7ebd626e08ab4c738112f89dd7c9f0cbede421780a96c79a0645d118d907280234fea4010ac96ea35f53759f0766b135c10d578aefe6f6b55ec6d33

Download Submit
memory/1336-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1336-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1336-12-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2696-100-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2696-161-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads