Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2023, 17:32

General

  • Target

    NEAS.47df846f2474f2d5f3740bab34809780.exe

  • Size

    503KB

  • MD5

    47df846f2474f2d5f3740bab34809780

  • SHA1

    61a374d20110e81c795b4e030eb68a4557f999e7

  • SHA256

    28b32e9aca33e5a25b11cb6969e19a510ae61de995360757f44617e81b3e51ad

  • SHA512

    6f1425bb910ca7f5e14ee127eaa9092cb2578180ee2ec0c1a405220e0e1e943bf944bab04861207a03754fe07e2306b37edc071cc98cdb9213a0da0ca66936fe

  • SSDEEP

    6144:HVlQoVHWO7MMJlfJIcSOPlgvmZgk/zDg5Ag2X80DMSFsv5mP84kYCs5uUTcPbLUp:1bV9MMJfLESiwPoWTc8ogV9MMJfL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.47df846f2474f2d5f3740bab34809780.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.47df846f2474f2d5f3740bab34809780.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 688
      2⤵
      • Program crash
      PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\d72ef588-252f-4e4f-9dd2-638a8a91caf1\CliSecureRT.dll

    Filesize

    128KB

    MD5

    ddb59f5d58f9ef6ca1baae89fa7dc8c6

    SHA1

    eb761e6e5925c8f0c97248338fa4e4ff863d35d5

    SHA256

    2318fe71778c615fc54f58c0347c58ce2a0c2d6e2eed50bffddde7ccb24e924d

    SHA512

    662a345535f12acd240a206906f40a7e09b95dc5c79eafcd99ef1e9c398360791d38e0522724c594c572256af06070349875637d8a7c939a041103c327b4c33e

  • \Users\Admin\AppData\Local\Temp\d72ef588-252f-4e4f-9dd2-638a8a91caf1\CliSecureRT.dll

    Filesize

    128KB

    MD5

    ddb59f5d58f9ef6ca1baae89fa7dc8c6

    SHA1

    eb761e6e5925c8f0c97248338fa4e4ff863d35d5

    SHA256

    2318fe71778c615fc54f58c0347c58ce2a0c2d6e2eed50bffddde7ccb24e924d

    SHA512

    662a345535f12acd240a206906f40a7e09b95dc5c79eafcd99ef1e9c398360791d38e0522724c594c572256af06070349875637d8a7c939a041103c327b4c33e

  • memory/652-0-0x0000000000A90000-0x0000000000B12000-memory.dmp

    Filesize

    520KB

  • memory/652-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

    Filesize

    6.9MB

  • memory/652-2-0x0000000004B60000-0x0000000004BA0000-memory.dmp

    Filesize

    256KB

  • memory/652-10-0x0000000010000000-0x0000000010031000-memory.dmp

    Filesize

    196KB

  • memory/652-9-0x0000000073FD0000-0x0000000074050000-memory.dmp

    Filesize

    512KB

  • memory/652-12-0x00000000741D0000-0x00000000748BE000-memory.dmp

    Filesize

    6.9MB

  • memory/652-13-0x0000000004B60000-0x0000000004BA0000-memory.dmp

    Filesize

    256KB

  • memory/652-14-0x0000000010000000-0x0000000010031000-memory.dmp

    Filesize

    196KB