419cc98791428a6ffe65695181afb79752ef18196c79f50a2990e26cef0a084c

General

Target

NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe
Size

209KB
MD5

bfbe772546f5299a17d5dc26a0b72377
SHA1

eed93b5e8bfef82f6cff064e4880d3798ab5fb96
SHA256

419cc98791428a6ffe65695181afb79752ef18196c79f50a2990e26cef0a084c
SHA512

ac8ac13f5f23bcc15684f69cc2809aeb93cc510c14024ea6fa510a76e6ba66a6ed6f8a5aa42fa3282a7a47db9574830d821be7ec544de5b7897d485b4f1af520
SSDEEP

3072:1Qcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:1Qh9tVRm2kh34hdeCkcG7DEALLlnN

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3832	svchost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/216-1-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/216-12-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/3832-13-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/3832-18-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\8f3f93df = "C:\\Windows\\apppatch\\svchost.exe"	NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\8f3f93df = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\apppatch\svchost.exe	NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe
File created	C:\Windows\apppatch\svchost.exe	NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3832	svchost.exe
3832	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
216	NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3832	216	NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe	82
PID 216 wrote to memory of 3832	216	NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe	82
PID 216 wrote to memory of 3832	216	NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASbfbe772546f5299a17d5dc26a0b72377exe_JC.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
fe6a02968420b5883688245806549c87

SHA1
00a376f9b0f865ee2d895f6f50dcf5bc90e01411

SHA256
6b9ed309b7e5b888eaaa39cac412749b9f37c6cd896774603b7b8492d5e2eff2

SHA512
8fc6cd186c4127b7e0fd810ce5709ecdebd79f2c9f4a11863cb30d4b0b90c86456d7910a96976f9188ff390d6f010ce94060e82be1f717b652ce32f7f1100238

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
fe6a02968420b5883688245806549c87

SHA1
00a376f9b0f865ee2d895f6f50dcf5bc90e01411

SHA256
6b9ed309b7e5b888eaaa39cac412749b9f37c6cd896774603b7b8492d5e2eff2

SHA512
8fc6cd186c4127b7e0fd810ce5709ecdebd79f2c9f4a11863cb30d4b0b90c86456d7910a96976f9188ff390d6f010ce94060e82be1f717b652ce32f7f1100238

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
fe6a02968420b5883688245806549c87

SHA1
00a376f9b0f865ee2d895f6f50dcf5bc90e01411

SHA256
6b9ed309b7e5b888eaaa39cac412749b9f37c6cd896774603b7b8492d5e2eff2

SHA512
8fc6cd186c4127b7e0fd810ce5709ecdebd79f2c9f4a11863cb30d4b0b90c86456d7910a96976f9188ff390d6f010ce94060e82be1f717b652ce32f7f1100238

Download Submit
memory/216-12-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/216-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/216-11-0x00000000021B0000-0x0000000002208000-memory.dmp

Filesize
352KB

Download
memory/216-0-0x00000000021B0000-0x0000000002208000-memory.dmp

Filesize
352KB

Download
memory/3832-13-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3832-14-0x0000000002A00000-0x0000000002A8A000-memory.dmp

Filesize
552KB

Download
memory/3832-16-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/3832-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3832-20-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/3832-21-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/3832-22-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download
memory/3832-25-0x0000000002B90000-0x0000000002C29000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads