de05e01b6962ae66463871ee589695a9427779e0245ecc6b573f85c34dcf7841

Analysis

max time kernel
28s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
Size

7.4MB
MD5

dbfbd1976c0723e9eaf7ea16e8d77d60
SHA1

fe76266e502911ff39fc85d8130fba7af138bd9e
SHA256

de05e01b6962ae66463871ee589695a9427779e0245ecc6b573f85c34dcf7841
SHA512

39fcc21078dd35dacf753d564c2342ded67d11d629c44660543554c7eca41944088828f4dc7f4ac280d32de9f29414a4361d1c902496b672a28aaf43770ed309
SSDEEP

196608:Ub3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mIbOyg8d5KOz:Ub3bPk5HPhJCIbOyg8d53

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2780-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2780-1-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\ehome\ehexthost.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehrecvr.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\mcGlidHost.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\MediaCenterWebLauncher.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\CreateDisc\SBEServer.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\mcspad.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\Mcx2Prov.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\RegisterMCEApp.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\loadmxf.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehsched.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\McrMgr.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\Boot\PCAT\memtest.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehprivjob.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\explorer.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\bfsvc.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\mcupdate.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\WTVConverter.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehmsas.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehtray.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\wow\ehexthost32.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\fveupdate.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehvid.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\McxTask.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehrec.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
File created	C:\Windows\ehome\ehshell.exe	NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dbfbd1976c0723e9eaf7ea16e8d77d60.exe"
1⤵
- Drops file in Windows directory
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2780-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads