Overview

overview

10

Static

static

7

NEAS.286ef...JC.exe

windows7-x64

10

NEAS.286ef...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.286ef1f7d7582424e133d9b9e24e0b60_JC.exe

  • Size

    405KB

  • Sample

    231016-wef5aabb9t

  • MD5

    286ef1f7d7582424e133d9b9e24e0b60

  • SHA1

    132fecad01b63a50f07315ab33ad166bc435f110

  • SHA256

    5dd69750aefda671f4efc43071510d3c82d5319421cf65e000ed5d5eb77ce601

  • SHA512

    6fa4bbfd01d442ec55f1559ae7f36a712e3b410e07baf722e1fa632cdce7a11624a3479d83c98d348831d24d6ffe49f7f6398e7f7df5e895a544adedb819a990

  • SSDEEP

    12288:TLy95DK0kXWCnlboVrDMleeew1+AeelUHZ+9P:T+95DK0kXWulbYoleeewveeiHQ

Score
10/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      NEAS.286ef1f7d7582424e133d9b9e24e0b60_JC.exe

    • Size

      405KB

    • MD5

      286ef1f7d7582424e133d9b9e24e0b60

    • SHA1

      132fecad01b63a50f07315ab33ad166bc435f110

    • SHA256

      5dd69750aefda671f4efc43071510d3c82d5319421cf65e000ed5d5eb77ce601

    • SHA512

      6fa4bbfd01d442ec55f1559ae7f36a712e3b410e07baf722e1fa632cdce7a11624a3479d83c98d348831d24d6ffe49f7f6398e7f7df5e895a544adedb819a990

    • SSDEEP

      12288:TLy95DK0kXWCnlboVrDMleeew1+AeelUHZ+9P:T+95DK0kXWulbYoleeewveeiHQ

    Score
    10/10
    adwarepersistencestealerupx

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks