4276ea3105200e6977c21cbff7cb9f5c3b770590c619a5591084fe7ce4ea1d6e

Analysis

max time kernel
180s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c5e5287cf17a6e1286c1870ed609d440.exe
Size

442KB
MD5

c5e5287cf17a6e1286c1870ed609d440
SHA1

9d5e9e57f81ffa2f7d27feb7b291a28b3aab57f7
SHA256

4276ea3105200e6977c21cbff7cb9f5c3b770590c619a5591084fe7ce4ea1d6e
SHA512

1de4e586e8317de670a6fe1cbae9690f44a694e4a9e512b6991b54758b7d7d32d09fd046f494e389a1ad85a87a0d3d1ffcd601e11f33b972576a4e274ad1c5df
SSDEEP

6144:0bLcJllOiAp2ZkHMudTBl2MuyzLBP4sjMzqSPAIjfzk4H2q/yGYs88QgMuSZ:0f0lpZksudTD2MNPUE4H1jxQ/uE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1500	1C7C.tmp

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll	1C7C.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL	1C7C.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Csi.dll	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mfc140u.dll	1C7C.tmp
File opened for modification	C:\Program Files\7-Zip\7z.sfx	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADAL.DLL	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADALPREVIOUS.DLL	1C7C.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\concrt140.dll	1C7C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1500	2816	NEAS.c5e5287cf17a6e1286c1870ed609d440.exe	89
PID 2816 wrote to memory of 1500	2816	NEAS.c5e5287cf17a6e1286c1870ed609d440.exe	89
PID 2816 wrote to memory of 1500	2816	NEAS.c5e5287cf17a6e1286c1870ed609d440.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.c5e5287cf17a6e1286c1870ed609d440.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c5e5287cf17a6e1286c1870ed609d440.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\1C7C.tmp
  C:\Users\Admin\AppData\Local\Temp\1C7C.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1C7C.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2816-0-0x0000000000620000-0x000000000065F000-memory.dmp

Filesize
252KB

Download
memory/2816-1-0x0000000000620000-0x000000000065F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads