094b44a463f284f43bbfb8454a78c479c02927250d421d25826a72f27076818a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.47f4266df236ae801c0476e14fa12130.exe
Size

397KB
MD5

47f4266df236ae801c0476e14fa12130
SHA1

e0d6414f2f469ceb472cf6d7a18cdc5247881d01
SHA256

094b44a463f284f43bbfb8454a78c479c02927250d421d25826a72f27076818a
SHA512

2b7cc6466d9d02c7670210db836651c75297c4334ee7a899f606df8201075cd73b30803648545b674bbdf453b791c7486b7b44c9953a3c21756f4c78701994e2
SSDEEP

6144:GLiuv8j7ZuA5ErOOze1QXh0jfLwhkLX3fgZXVK7iRyM1KTlbfLWqqZy8JqMxLh:wi1x55UIEhlCXvkXVg8IBjLvl8NLh

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2668	xvqykzi.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\xvqykzi.exe	NEAS.47f4266df236ae801c0476e14fa12130.exe
File created	C:\PROGRA~3\Mozilla\zyfdqqb.dll	xvqykzi.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2668	2564	taskeng.exe	29
PID 2564 wrote to memory of 2668	2564	taskeng.exe	29
PID 2564 wrote to memory of 2668	2564	taskeng.exe	29
PID 2564 wrote to memory of 2668	2564	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.47f4266df236ae801c0476e14fa12130.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.47f4266df236ae801c0476e14fa12130.exe"
1⤵
- Drops file in Program Files directory
PID:2220

C:\Windows\system32\taskeng.exe
taskeng.exe {92C1BF36-1106-4BFE-942D-1867F61B8124} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\PROGRA~3\Mozilla\xvqykzi.exe
  C:\PROGRA~3\Mozilla\xvqykzi.exe -tkarfve
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\xvqykzi.exe

Filesize
397KB

MD5
ca017841105c17846964b5a3b63387ca

SHA1
e316c1763fdeea886684e91a50608819088121b2

SHA256
742c5edb0455e67b3b00cadd02b7ca1333bafc8e5f66386fe99ebfca755d35f6

SHA512
83046b0f5172a280f608e51ab42c503a3fb24601289bbea8fd65a81024a69135dc8e7ac25fd0f9e5ae22afaaa77a608f5ab013af29daee80424a12e2959dbed1

Download Submit
C:\PROGRA~3\Mozilla\xvqykzi.exe

Filesize
397KB

MD5
ca017841105c17846964b5a3b63387ca

SHA1
e316c1763fdeea886684e91a50608819088121b2

SHA256
742c5edb0455e67b3b00cadd02b7ca1333bafc8e5f66386fe99ebfca755d35f6

SHA512
83046b0f5172a280f608e51ab42c503a3fb24601289bbea8fd65a81024a69135dc8e7ac25fd0f9e5ae22afaaa77a608f5ab013af29daee80424a12e2959dbed1

Download Submit
memory/2220-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2220-1-0x0000000000230000-0x000000000028B000-memory.dmp

Filesize
364KB

Download
memory/2220-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2668-10-0x0000000000390000-0x00000000003EB000-memory.dmp

Filesize
364KB

Download
memory/2668-16-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download