bc1a1e026f202197d17d824307aeec00da0f223b48d93aa3fbc944f9514d0c5e

Analysis

max time kernel
230s
max time network
44s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.8f416b932ffaa66bb4a3f4d1eb9cb9e0.dll
Size

3.2MB
MD5

8f416b932ffaa66bb4a3f4d1eb9cb9e0
SHA1

f82c380503f9a4550540d15538bb7a6335ee9785
SHA256

bc1a1e026f202197d17d824307aeec00da0f223b48d93aa3fbc944f9514d0c5e
SHA512

c4d31657457287f686294147586bbe042fb303780cb0fdb14987303f9968194ffc424c71115949fead333dae648151a35049f974921d69c67140879c5a2a3cb4
SSDEEP

49152:kSfzhp0te3JwjDX6N68+eNH95LoQQJqboxHp8EzvjVT+6uud1T7uZPYa:kSbhp0t2OToZN3oQQJigpx+fuLuZP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2996	6068.tmp

Loads dropped DLL 2 IoCs

pid	Process
2664	regsvr32.exe
2664	regsvr32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FDATE.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1XTOR.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api	6068.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\xmlrw.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	6068.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\WTSP61MS.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPLACE.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\System\MSMAPI\1033\MSMAPI32.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IETAG.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CORE.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\msitss55.dll	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	6068.tmp
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	6068.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL	6068.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL	6068.tmp

Modifies registry class 42 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\ = "InkAnalyzer Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion.2\CLSID\ = "{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion\CLSID\ = "{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer.2\CLSID\ = "{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer\ = "InkAnalyzer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer\CLSID\ = "{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4FD9-AAD9-C3A9C281D436}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\ProgID\ = "ComInkAnalysislib.InkAnalyzer.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion\ = "AnalysisRegion Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion.2\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer.2\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.8f416b932ffaa66bb4a3f4d1eb9cb9e0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion.2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\VersionIndependentProgID\ = "ComInkAnalysislib.AnalysisRegion"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.8f416b932ffaa66bb4a3f4d1eb9cb9e0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer.2\ = "InkAnalyzer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\ = "AnalysisRegion Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion\CurVer\ = "ComInkAnalysislib.AnalysisRegion.2"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43E2-8606-BDDDB6AC8A9D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\ProgID\ = "ComInkAnalysislib.AnalysisRegion.2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion.2\ = "AnalysisRegion Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43e2-8606-BDDDB6AC8A9D}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer\CurVer\ = "ComInkAnalysislib.InkAnalyzer.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\VersionIndependentProgID\ = "ComInkAnalysislib.InkAnalyzer"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{485AB41A-ABA1-43E2-8606-BDDDB6AC8A9D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer.2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.InkAnalyzer\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4FD9-AAD9-C3A9C281D436}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C297D6BC-928D-4fd9-AAD9-C3A9C281D436}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComInkAnalysislib.AnalysisRegion\CurVer	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2664	2892	regsvr32.exe	27
PID 2892 wrote to memory of 2664	2892	regsvr32.exe	27
PID 2892 wrote to memory of 2664	2892	regsvr32.exe	27
PID 2892 wrote to memory of 2664	2892	regsvr32.exe	27
PID 2892 wrote to memory of 2664	2892	regsvr32.exe	27
PID 2892 wrote to memory of 2664	2892	regsvr32.exe	27
PID 2892 wrote to memory of 2664	2892	regsvr32.exe	27
PID 2664 wrote to memory of 2996	2664	regsvr32.exe	28
PID 2664 wrote to memory of 2996	2664	regsvr32.exe	28
PID 2664 wrote to memory of 2996	2664	regsvr32.exe	28
PID 2664 wrote to memory of 2996	2664	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.8f416b932ffaa66bb4a3f4d1eb9cb9e0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.8f416b932ffaa66bb4a3f4d1eb9cb9e0.dll
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\6068.tmp
    C:\Users\Admin\AppData\Local\Temp\6068.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6068.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\6068.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\6068.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\6068.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\6068.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2664-0-0x0000000001E20000-0x0000000001EB3000-memory.dmp

Filesize
588KB

Download
memory/2664-1-0x0000000001E20000-0x0000000001EB3000-memory.dmp

Filesize
588KB

Download