5216ccdb01e2ab675b323b725d904dd09221bcdf62b59d3fdfff0fb236909eac

Analysis

max time kernel
153s
max time network
165s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe
Size

45KB
MD5

0942b5b3c64caaee17c71b4f3ad88bb0
SHA1

e4f987c765469612110478ca5829fec2df51237f
SHA256

5216ccdb01e2ab675b323b725d904dd09221bcdf62b59d3fdfff0fb236909eac
SHA512

866999fda339d126ced6ed80acccee7964496b71a722cc70534202e571fa73bade8d7905d52ee9b8def73601abb9b1717b7dfc782a46e933f1636d8e98090b38
SSDEEP

768:NLhcSDgpxUueqk230wHmIOdic+AvALExifcdN0H:NLhcRLleqk4rTOdbvAw9NS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	codecupdate.exe

Loads dropped DLL 1 IoCs

pid	Process
2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2160	2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe	28
PID 2208 wrote to memory of 2160	2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe	28
PID 2208 wrote to memory of 2160	2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe	28
PID 2208 wrote to memory of 2160	2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe	28
PID 2208 wrote to memory of 2160	2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe	28
PID 2208 wrote to memory of 2160	2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe	28
PID 2208 wrote to memory of 2160	2208	NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0942b5b3c64caaee17c71b4f3ad88bb0_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\codecupdate.exe
  "C:\Users\Admin\AppData\Local\Temp\codecupdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\codecupdate.exe

Filesize
45KB

MD5
672eaded37999bd6728ff3f67d70bde2

SHA1
5fcaaa40b93d4e177ce7cfc5823df10d68cadda4

SHA256
7711bf073bf80dd72f8a40929c479456bba1645e3b36ed4c7ce84d0a18edfe6d

SHA512
7b92464fb5d7875884fa049f838aca8e163a3f8750657a3169325682baa4751c37898c7f7fa2227fb8e7c325b67c578eff04f27413e66abce71ec47a1bdaa7aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\codecupdate.exe

Filesize
45KB

MD5
672eaded37999bd6728ff3f67d70bde2

SHA1
5fcaaa40b93d4e177ce7cfc5823df10d68cadda4

SHA256
7711bf073bf80dd72f8a40929c479456bba1645e3b36ed4c7ce84d0a18edfe6d

SHA512
7b92464fb5d7875884fa049f838aca8e163a3f8750657a3169325682baa4751c37898c7f7fa2227fb8e7c325b67c578eff04f27413e66abce71ec47a1bdaa7aa

Download Submit
\Users\Admin\AppData\Local\Temp\codecupdate.exe

Filesize
45KB

MD5
672eaded37999bd6728ff3f67d70bde2

SHA1
5fcaaa40b93d4e177ce7cfc5823df10d68cadda4

SHA256
7711bf073bf80dd72f8a40929c479456bba1645e3b36ed4c7ce84d0a18edfe6d

SHA512
7b92464fb5d7875884fa049f838aca8e163a3f8750657a3169325682baa4751c37898c7f7fa2227fb8e7c325b67c578eff04f27413e66abce71ec47a1bdaa7aa

Download Submit
memory/2160-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2208-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download