32e95e4eb96112726e47b0564be05343d53cf5231dbc6f486372f7fe18fedb18

Analysis

max time kernel
116s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe
Size

4.5MB
MD5

10f858cfc5765877e5c2c635bbefb0e9
SHA1

afc0390a93295804ce3722ad8c835eb6c65a67bc
SHA256

32e95e4eb96112726e47b0564be05343d53cf5231dbc6f486372f7fe18fedb18
SHA512

a26875922f7a19aa05b76dcf2db018f3bd80123fbae2daa9ff011543ecc4a0fa382045c77835f2246522c62b6f8f6e8525f7dfb8778e4b9b659d5a4e498aa9d8
SSDEEP

49152:V4gTnY4gT0GT0dgT0GTrTnY4gT0DYqgTnxYqgTtTd9TrTnY4gT0DYqgTnxYqgTt8:V4uF48F4Y

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe
1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28
PID 1664 wrote to memory of 1728	1664	NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS10f858cfc5765877e5c2c635bbefb0e9exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\wyyzabb.exe
  C:\Users\Admin\AppData\Local\Temp\wyyzabb.exe
  2⤵
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wyyzabb.exe

Filesize
4.6MB

MD5
853590019ccf00fa3f2918308e5d8f17

SHA1
49fc4022c4a5df84f051d97ad0956eafe2cc0d3f

SHA256
8e79c7efe9c333a47ab75b956f1d8719336c1b966c7811637ef63ba56a1b7295

SHA512
24adb904032c6bdd6b7bf6426d63a9821d050633190f103e4a682dccfcb0ddc704b4bd3c88d0c02c5831bd98399175ccc7bbef676a74e7a446bd9fe423de26e9

Download Submit
\Users\Admin\AppData\Local\Temp\wyyzabb.exe

Filesize
4.6MB

MD5
853590019ccf00fa3f2918308e5d8f17

SHA1
49fc4022c4a5df84f051d97ad0956eafe2cc0d3f

SHA256
8e79c7efe9c333a47ab75b956f1d8719336c1b966c7811637ef63ba56a1b7295

SHA512
24adb904032c6bdd6b7bf6426d63a9821d050633190f103e4a682dccfcb0ddc704b4bd3c88d0c02c5831bd98399175ccc7bbef676a74e7a446bd9fe423de26e9

Download Submit
\Users\Admin\AppData\Local\Temp\wyyzabb.exe

Filesize
4.6MB

MD5
853590019ccf00fa3f2918308e5d8f17

SHA1
49fc4022c4a5df84f051d97ad0956eafe2cc0d3f

SHA256
8e79c7efe9c333a47ab75b956f1d8719336c1b966c7811637ef63ba56a1b7295

SHA512
24adb904032c6bdd6b7bf6426d63a9821d050633190f103e4a682dccfcb0ddc704b4bd3c88d0c02c5831bd98399175ccc7bbef676a74e7a446bd9fe423de26e9

Download Submit
memory/1728-33-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-41-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-9-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-13-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-15-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-19-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-17-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-21-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-39-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-25-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-27-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-29-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-31-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-7-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-11-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-35-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-23-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-37-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-43-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-45-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-47-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-49-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-51-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-53-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-55-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-57-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-59-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-61-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-63-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-65-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-67-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1728-69-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads