01775091c988493242bfa729e0fcd20df9942581aaf9b0e0e217945b4ae93117

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe
Size

932KB
MD5

67a4684a51d2e106b3f069a6f28e05f0
SHA1

9fb5c126859d57ae108d1745a3a329662ba94ed4
SHA256

01775091c988493242bfa729e0fcd20df9942581aaf9b0e0e217945b4ae93117
SHA512

656aaba07d4cde3273a0ae4102892c23b9ddc66aedb7c25aa94aa72c66fee8fdda29d7a326d319017d2747467f2ea17f01b0d0dfbb6ca29d572cb9776029b4f2
SSDEEP

12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdqLYF9mH7EEV:P1/aGLDCM4D8ayGMZo8/Nm/a2dLy0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4292	xsbac.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\xsbac.exe"	xsbac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4292	892	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe	90
PID 892 wrote to memory of 4292	892	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe	90
PID 892 wrote to memory of 4292	892	NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\ProgramData\xsbac.exe
  "C:\ProgramData\xsbac.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
932KB

MD5
40f66a658b5df1c38688b3aa4f41ef0b

SHA1
fb9b1ae804bd378eb4f722d9c74b095da3bf2d9e

SHA256
868380ea449a5a8c0627b34a980939d11b36330374ea68cbd5b71993403610ce

SHA512
97042030107bb11ef1106b6ef52dc01da9e6789577801aedf2e81d224a3d4e21d276b17eb72ac40bb607af029b170df306afa1ab736e51a5d4c1dc4ae90645c1

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
70d6cb7dd01ebd5a21af02945d2ae12f

SHA1
05260b3e17a221e66b58d1e5ed1d0f518392159a

SHA256
136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

SHA512
b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
70d6cb7dd01ebd5a21af02945d2ae12f

SHA1
05260b3e17a221e66b58d1e5ed1d0f518392159a

SHA256
136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

SHA512
b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

Download Submit
C:\ProgramData\xsbac.exe

Filesize
454KB

MD5
9425be4ca83d4074d9548660c44f5f00

SHA1
001a9605a60078afed240145d161d4e9e6ad33d6

SHA256
1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

SHA512
fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

Download Submit
C:\ProgramData\xsbac.exe

Filesize
454KB

MD5
9425be4ca83d4074d9548660c44f5f00

SHA1
001a9605a60078afed240145d161d4e9e6ad33d6

SHA256
1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

SHA512
fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

Download Submit
memory/892-7-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4292-70-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads