Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18/10/2023, 17:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.NEASNEAS44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4exeexeexe_JC.exe
Resource
win7-20230831-en
General
-
Target
NEAS.NEASNEAS44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4exeexeexe_JC.exe
-
Size
233KB
-
MD5
8b0d8b308332ef988f2808fc0ae107bb
-
SHA1
65e51a73e4b10891c01c715e91e1a8910b870068
-
SHA256
44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4
-
SHA512
820acd2abc76b870b5ab4a2bf263c5e69b1074e6bdccacf0d371508ac85e0c21a94ab2f4035afb8412c7952d63afc00b0c2e3d07cc320d4b617ff8254741ea7a
-
SSDEEP
3072:8pOlh7XHcENewtYSYyOyyCKMqBEHHgpNI0deb4NoVr7d7u1epKpK:8pIlQwyzCB2EHHgpNIJb4NoFpcGKY
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2916 NEAS.NEASNEAS44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4exeexeexe_JC.exe 2916 NEAS.NEASNEAS44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4exeexeexe_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2916 NEAS.NEASNEAS44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4exeexeexe_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4exeexeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4exeexeexe_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916