01775091c988493242bfa729e0fcd20df9942581aaf9b0e0e217945b4ae93117

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe
Size

932KB
MD5

67a4684a51d2e106b3f069a6f28e05f0
SHA1

9fb5c126859d57ae108d1745a3a329662ba94ed4
SHA256

01775091c988493242bfa729e0fcd20df9942581aaf9b0e0e217945b4ae93117
SHA512

656aaba07d4cde3273a0ae4102892c23b9ddc66aedb7c25aa94aa72c66fee8fdda29d7a326d319017d2747467f2ea17f01b0d0dfbb6ca29d572cb9776029b4f2
SSDEEP

12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdqLYF9mH7EEV:P1/aGLDCM4D8ayGMZo8/Nm/a2dLy0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1528	vqxji.exe

Loads dropped DLL 2 IoCs

pid	Process
2200	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe
2200	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\vqxji.exe"	vqxji.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1528	2200	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe	28
PID 2200 wrote to memory of 1528	2200	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe	28
PID 2200 wrote to memory of 1528	2200	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe	28
PID 2200 wrote to memory of 1528	2200	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200
- C:\ProgramData\vqxji.exe
  "C:\ProgramData\vqxji.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache .exe

Filesize
932KB

MD5
b22f5244171de65ba3054af54eed3bea

SHA1
e86c6315189ad8c99e9ea81f42715760a22b1f5e

SHA256
adb18575dc1687bb2d41375ab87117688e81eda9d3f79cc81771d947890124c4

SHA512
fdd5e233f61804a50202349119616052638a43bce89cc72948e3547d85d0f46b0602408e12bdfd168c27ebea2eff8dae8dc7500d1cb98d6c8971822e7dca39d0

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
70d6cb7dd01ebd5a21af02945d2ae12f

SHA1
05260b3e17a221e66b58d1e5ed1d0f518392159a

SHA256
136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

SHA512
b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

Download Submit
C:\ProgramData\vqxji.exe

Filesize
454KB

MD5
9425be4ca83d4074d9548660c44f5f00

SHA1
001a9605a60078afed240145d161d4e9e6ad33d6

SHA256
1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

SHA512
fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

Download Submit
C:\ProgramData\vqxji.exe

Filesize
454KB

MD5
9425be4ca83d4074d9548660c44f5f00

SHA1
001a9605a60078afed240145d161d4e9e6ad33d6

SHA256
1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

SHA512
fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

Download Submit
C:\ProgramData\vqxji.exe

Filesize
454KB

MD5
9425be4ca83d4074d9548660c44f5f00

SHA1
001a9605a60078afed240145d161d4e9e6ad33d6

SHA256
1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

SHA512
fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

Download Submit
\ProgramData\vqxji.exe

Filesize
454KB

MD5
9425be4ca83d4074d9548660c44f5f00

SHA1
001a9605a60078afed240145d161d4e9e6ad33d6

SHA256
1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

SHA512
fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

Download Submit
\ProgramData\vqxji.exe

Filesize
454KB

MD5
9425be4ca83d4074d9548660c44f5f00

SHA1
001a9605a60078afed240145d161d4e9e6ad33d6

SHA256
1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

SHA512
fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

Download Submit
memory/1528-100-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2200-10-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads