Overview

overview

7

Static

static

5

NEAS.3e564...20.exe

windows7-x64

7

NEAS.3e564...20.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.3e56412906e0d15d25c9058da9295320.exe

  • Size

    648KB

  • Sample

    231016-wxq27scd4x

  • MD5

    3e56412906e0d15d25c9058da9295320

  • SHA1

    b98fc1af25e2a93bfb3fcbc776b07f4cf0b9960a

  • SHA256

    380d119824b320133affeda89f72d486f315ce81a2f129dee6593516db711321

  • SHA512

    7d0bd736a5bc335bb76e090c9072a8451ccf0013b7427d07383c952c9e1b0be5dd89949832a0108a8879e6060792e0b33edb298335c621d5bbaf541012756b3b

  • SSDEEP

    12288:kH7Wcjdc/r2sxxiPGGAOOPSXDV8ClgVYhX5FSV89iE1:kbCj2sObHtqQA89i

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      NEAS.3e56412906e0d15d25c9058da9295320.exe

    • Size

      648KB

    • MD5

      3e56412906e0d15d25c9058da9295320

    • SHA1

      b98fc1af25e2a93bfb3fcbc776b07f4cf0b9960a

    • SHA256

      380d119824b320133affeda89f72d486f315ce81a2f129dee6593516db711321

    • SHA512

      7d0bd736a5bc335bb76e090c9072a8451ccf0013b7427d07383c952c9e1b0be5dd89949832a0108a8879e6060792e0b33edb298335c621d5bbaf541012756b3b

    • SSDEEP

      12288:kH7Wcjdc/r2sxxiPGGAOOPSXDV8ClgVYhX5FSV89iE1:kbCj2sObHtqQA89i

    Score
    7/10
    persistencespywarestealer

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks