af07d817ad6ffe7d5c4de2e5e83c9b57ad2254c85f8cbbbbdb1a0cae38861697 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:36 UTC

Sharing

Report Analysis Logs

General

Target

NEAS.c5197dee39906435ec3a1e42ec079430.exe
Size

3.8MB
MD5

c5197dee39906435ec3a1e42ec079430
SHA1

b83c5e0b9c55483ef9ce36f488d85657ff7f033c
SHA256

af07d817ad6ffe7d5c4de2e5e83c9b57ad2254c85f8cbbbbdb1a0cae38861697
SHA512

f6806637819d39939c69720601530029572b98a82908110bfad466f42cc9a06311bee578e408457157f4e758583d80aa013b02327f0d6f044b524c1acfd39099
SSDEEP

49152:TUUghQkIOTH2rW2GHOtZS4tC5209er30kQ7X/7v2:TUt2GYyPe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2084	NEAS.c5197dee39906435ec3a1e42ec079430.exe
2084	NEAS.c5197dee39906435ec3a1e42ec079430.exe
2084	NEAS.c5197dee39906435ec3a1e42ec079430.exe
2084	NEAS.c5197dee39906435ec3a1e42ec079430.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2152	2084	NEAS.c5197dee39906435ec3a1e42ec079430.exe	28
PID 2084 wrote to memory of 2152	2084	NEAS.c5197dee39906435ec3a1e42ec079430.exe	28
PID 2084 wrote to memory of 2152	2084	NEAS.c5197dee39906435ec3a1e42ec079430.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c5197dee39906435ec3a1e42ec079430.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c5197dee39906435ec3a1e42ec079430.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\usb\usb.exe
  2⤵
  PID:2152

Network

No results found

No results found

127.0.0.1:6669

NEAS.c5197dee39906435ec3a1e42ec079430.exe
127.0.0.1:6667

NEAS.c5197dee39906435ec3a1e42ec079430.exe

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000000400000-0x00000000007DD000-memory.dmp

Filesize
3.9MB

Download