Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.8930746b2f0c52a72f232418503f2390.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.8930746b2f0c52a72f232418503f2390.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.8930746b2f0c52a72f232418503f2390.exe
-
Size
121KB
-
MD5
8930746b2f0c52a72f232418503f2390
-
SHA1
dc5ae69a96907745d5219af5a53b2e8ebd458cf0
-
SHA256
0d5a02333ad55d684fd2f16b8828fd0bf52439607a6fb8415868b9305f67bf06
-
SHA512
05e047aa542cb64243ebf8b5d9c8d175f12534a9d2dfc5a02a710d9a5734b1f2017330e8f5f35a70238b7964e12aab0c223b575f8b9259144f94690eb3303531
-
SSDEEP
1536:9YckrPAoIaoYNhCZ2VwPsZZLbTbVlyO2ntg7sUdr8:wVFoGEZ2+0Hb/VlR2ty7e
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\35181 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccxafwce.exe" svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 3060 NEAS.8930746b2f0c52a72f232418503f2390.exe -
Loads dropped DLL 1 IoCs
pid Process 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2380 set thread context of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccxafwce.exe svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3060 NEAS.8930746b2f0c52a72f232418503f2390.exe 3060 NEAS.8930746b2f0c52a72f232418503f2390.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2380 wrote to memory of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 PID 2380 wrote to memory of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 PID 2380 wrote to memory of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 PID 2380 wrote to memory of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 PID 2380 wrote to memory of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 PID 2380 wrote to memory of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 PID 2380 wrote to memory of 3060 2380 NEAS.8930746b2f0c52a72f232418503f2390.exe 28 PID 3060 wrote to memory of 2324 3060 NEAS.8930746b2f0c52a72f232418503f2390.exe 29 PID 3060 wrote to memory of 2324 3060 NEAS.8930746b2f0c52a72f232418503f2390.exe 29 PID 3060 wrote to memory of 2324 3060 NEAS.8930746b2f0c52a72f232418503f2390.exe 29 PID 3060 wrote to memory of 2324 3060 NEAS.8930746b2f0c52a72f232418503f2390.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8930746b2f0c52a72f232418503f2390.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8930746b2f0c52a72f232418503f2390.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\NEAS.8930746b2f0c52a72f232418503f2390.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8930746b2f0c52a72f232418503f2390.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
PID:2324
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD58930746b2f0c52a72f232418503f2390
SHA1dc5ae69a96907745d5219af5a53b2e8ebd458cf0
SHA2560d5a02333ad55d684fd2f16b8828fd0bf52439607a6fb8415868b9305f67bf06
SHA51205e047aa542cb64243ebf8b5d9c8d175f12534a9d2dfc5a02a710d9a5734b1f2017330e8f5f35a70238b7964e12aab0c223b575f8b9259144f94690eb3303531
-
Filesize
121KB
MD58930746b2f0c52a72f232418503f2390
SHA1dc5ae69a96907745d5219af5a53b2e8ebd458cf0
SHA2560d5a02333ad55d684fd2f16b8828fd0bf52439607a6fb8415868b9305f67bf06
SHA51205e047aa542cb64243ebf8b5d9c8d175f12534a9d2dfc5a02a710d9a5734b1f2017330e8f5f35a70238b7964e12aab0c223b575f8b9259144f94690eb3303531