5683513b700ad098d4eb9d87e4cbef2f9f2abc0192d0ea4d7e711ce509b01598

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f0e8a6ab781a16685554b3609c0bac80.exe
Size

168KB
MD5

f0e8a6ab781a16685554b3609c0bac80
SHA1

d4e791d90311a93ab477fc750a8821de1745900b
SHA256

5683513b700ad098d4eb9d87e4cbef2f9f2abc0192d0ea4d7e711ce509b01598
SHA512

3fb444b65c947348ba690408dd8ac867c4bfc724f8430f89bcd4c21370f7f1221ccdab97b6b6923cae9fcce1ab00d5c36aba2770d7d795f936fb7c8cd5bf5586
SSDEEP

3072:0W6h6Y6DxQKBL+UjcvS5is6vZX5Kv8S138WtA7Kzfk0saKt:0W6h6NR+Uw80g9XA78fJsaKt

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2656	zimfrwc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\zimfrwc.exe	NEAS.f0e8a6ab781a16685554b3609c0bac80.exe
File created	C:\PROGRA~3\Mozilla\pjqvbbf.dll	zimfrwc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2656	2820	taskeng.exe	31
PID 2820 wrote to memory of 2656	2820	taskeng.exe	31
PID 2820 wrote to memory of 2656	2820	taskeng.exe	31
PID 2820 wrote to memory of 2656	2820	taskeng.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.f0e8a6ab781a16685554b3609c0bac80.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f0e8a6ab781a16685554b3609c0bac80.exe"
1⤵
- Drops file in Program Files directory
PID:2192

C:\Windows\system32\taskeng.exe
taskeng.exe {5346A9AC-9F09-44B3-8547-8AC9D2126BCD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\PROGRA~3\Mozilla\zimfrwc.exe
  C:\PROGRA~3\Mozilla\zimfrwc.exe -gtjzibe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
168KB

MD5
6b6368441d314b6734490cfab9de4608

SHA1
04abaf7f24845647480fcffa1baef8c71a64527f

SHA256
5d3d676074078c1786e4df2c0e4ba6ac32816eefdf8bc6a972ba514a75d1996e

SHA512
89acdc146bc55a3ddce0f99dea6a9cd1a8db0108c35f6d4c3fc5c12cbc5b4237daf2988028593ff130c14767235eb3d574c5bd96718f63ee3f333faaee1c3f1c

Download Submit
C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
168KB

MD5
6b6368441d314b6734490cfab9de4608

SHA1
04abaf7f24845647480fcffa1baef8c71a64527f

SHA256
5d3d676074078c1786e4df2c0e4ba6ac32816eefdf8bc6a972ba514a75d1996e

SHA512
89acdc146bc55a3ddce0f99dea6a9cd1a8db0108c35f6d4c3fc5c12cbc5b4237daf2988028593ff130c14767235eb3d574c5bd96718f63ee3f333faaee1c3f1c

Download Submit
memory/2192-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2192-1-0x0000000000430000-0x000000000048B000-memory.dmp

Filesize
364KB

Download
memory/2192-6-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2656-16-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download