Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2023 21:25
Behavioral task
behavioral1
Sample
NEAS.85c12e8f5cde7902432dea5eaff70b50.exe
Resource
win7-20231020-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.85c12e8f5cde7902432dea5eaff70b50.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
NEAS.85c12e8f5cde7902432dea5eaff70b50.exe
-
Size
499KB
-
MD5
85c12e8f5cde7902432dea5eaff70b50
-
SHA1
191db6a77f0f44bdf4b408072d2fe8b05eb8eb37
-
SHA256
0568cce95dd3b00bba75de8f0af338c75b8d3a668a672f0f72987b08c0b9c0cb
-
SHA512
920ebf0c708e49625e02b526a82074568e4d7252160acef62552cb6589ec9d4d5e05c8c6fa477be2e95d504f6a252cc260d0ea718f020010b70d0f1a51ec2b0c
-
SSDEEP
12288:CjkArEN249AyE/rbaMcbEVHn7VvvpBjvrEH7R:1FE//TcYtNrEH7R
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0008000000022e29-2.dat acprotect behavioral2/files/0x0008000000022e29-10.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe -
resource yara_rule behavioral2/memory/4120-0-0x0000000000400000-0x00000000004DD000-memory.dmp upx behavioral2/files/0x0008000000022e29-2.dat upx behavioral2/memory/4120-5-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/files/0x0008000000022e29-10.dat upx behavioral2/memory/4120-19-0x0000000000400000-0x00000000004DD000-memory.dmp upx behavioral2/memory/4120-20-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4120-28-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4120-35-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4120-47-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: NEAS.85c12e8f5cde7902432dea5eaff70b50.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4120-19-0x0000000000400000-0x00000000004DD000-memory.dmp autoit_exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll NEAS.85c12e8f5cde7902432dea5eaff70b50.exe File created \??\c:\program files\common files\system\symsrv.dll.000 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe 4120 NEAS.85c12e8f5cde7902432dea5eaff70b50.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.85c12e8f5cde7902432dea5eaff70b50.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.85c12e8f5cde7902432dea5eaff70b50.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0