lucastealer | d881663244daab00c57fb1715aef3ce183da334236670ea520bbf0fd198a4b3d

Resubmissions

22-10-2023 04:26

231022-e2zfpsfa72 10

21-10-2023 21:13

231021-z27gjacf54 10

Analysis

max time kernel
63s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.13d37451cb332802b88bd5684f8a9f90.exe
Size

4.6MB
MD5

13d37451cb332802b88bd5684f8a9f90
SHA1

19c367dca209aff91e39aaedaa021e0c957502d0
SHA256

d881663244daab00c57fb1715aef3ce183da334236670ea520bbf0fd198a4b3d
SHA512

e38eadd8628cc6d6d8e0ef8538635328ec8d62292b1672fbc8a18c974fc1393879102746006ef5a13f1e52bbe4bf692e3111f54110427e4805e7a231b94c741a
SSDEEP

49152:CYhJZoQrbTFZY1ia/N8kHLlkMROX1lW68ZM5mmhD+SbilzCUWCLcMldpxruKihtB:zhtrbTA1OiWXLW6jRhdGVQguhhW31Z4

Score

10^/10

lucastealer evasion persistence stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	neas.13d37451cb332802b88bd5684f8a9f90.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CIJRTX.lnk	neas.13d37451cb332802b88bd5684f8a9f90.exe

Executes dropped EXE 11 IoCs

pid	Process
4912	neas.13d37451cb332802b88bd5684f8a9f90.exe
1744	icsys.icn.exe
1392	explorer.exe
3068	spoolsv.exe
3576	svchost.exe
2480	spoolsv.exe
4740	UPUGVT.exe
1048	RXLFSQ.exe
4860	upugvt.exe
2092	icsys.icn.exe
4980	explorer.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CIJRTX = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\Microsoft Office Click-to-Run.exe\""	neas.13d37451cb332802b88bd5684f8a9f90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0006000000022e1a-6.dat	autoit_exe
behavioral2/files/0x0006000000022e1a-8.dat	autoit_exe
behavioral2/files/0x0006000000022e28-86.dat	autoit_exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	1048	WerFault.exe	95

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
772	schtasks.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 500031000000000056576c2310004c6f63616c003c0009000400efbe5457548856576c232e000000a5e10100000001000000000000000000000000000000674c59004c006f00630061006c00000014000000	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000054575488120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe5457548856576c232e00000092e1010000000100000000000000000000000000000018ef0b004100700070004400610074006100000042000000	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000056576f23100054656d7000003a0009000400efbe5457548856576f232e000000a6e101000000010000000000000000000000000000001c74e400540065006d007000000014000000	RXLFSQ.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	RXLFSQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	RXLFSQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	RXLFSQ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	RXLFSQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	RXLFSQ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	RXLFSQ.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1744	icsys.icn.exe
1744	icsys.icn.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
1392	explorer.exe
3576	svchost.exe
1392	explorer.exe
3576	svchost.exe
1392	explorer.exe
3576	svchost.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
3576	svchost.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
1392	explorer.exe
4912	neas.13d37451cb332802b88bd5684f8a9f90.exe
4912	neas.13d37451cb332802b88bd5684f8a9f90.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe
1392	explorer.exe
1392	explorer.exe
3576	svchost.exe
3576	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4912	neas.13d37451cb332802b88bd5684f8a9f90.exe
1392	explorer.exe
3576	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4300	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4300	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe
1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe
1744	icsys.icn.exe
1744	icsys.icn.exe
1392	explorer.exe
1392	explorer.exe
3068	spoolsv.exe
3068	spoolsv.exe
3576	svchost.exe
3576	svchost.exe
2480	spoolsv.exe
2480	spoolsv.exe
4740	UPUGVT.exe
1048	RXLFSQ.exe
1392	explorer.exe
1392	explorer.exe
4740	UPUGVT.exe
2092	icsys.icn.exe
2092	icsys.icn.exe
4980	explorer.exe
4980	explorer.exe
1048	RXLFSQ.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4912	1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe	87
PID 1256 wrote to memory of 4912	1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe	87
PID 1256 wrote to memory of 4912	1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe	87
PID 1256 wrote to memory of 1744	1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe	88
PID 1256 wrote to memory of 1744	1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe	88
PID 1256 wrote to memory of 1744	1256	NEAS.13d37451cb332802b88bd5684f8a9f90.exe	88
PID 1744 wrote to memory of 1392	1744	icsys.icn.exe	89
PID 1744 wrote to memory of 1392	1744	icsys.icn.exe	89
PID 1744 wrote to memory of 1392	1744	icsys.icn.exe	89
PID 1392 wrote to memory of 3068	1392	explorer.exe	90
PID 1392 wrote to memory of 3068	1392	explorer.exe	90
PID 1392 wrote to memory of 3068	1392	explorer.exe	90
PID 4912 wrote to memory of 4740	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	91
PID 4912 wrote to memory of 4740	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	91
PID 4912 wrote to memory of 4740	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	91
PID 3068 wrote to memory of 3576	3068	spoolsv.exe	92
PID 3068 wrote to memory of 3576	3068	spoolsv.exe	92
PID 3068 wrote to memory of 3576	3068	spoolsv.exe	92
PID 3576 wrote to memory of 2480	3576	svchost.exe	94
PID 3576 wrote to memory of 2480	3576	svchost.exe	94
PID 3576 wrote to memory of 2480	3576	svchost.exe	94
PID 4912 wrote to memory of 1048	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	95
PID 4912 wrote to memory of 1048	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	95
PID 4912 wrote to memory of 1048	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	95
PID 3576 wrote to memory of 5048	3576	svchost.exe	96
PID 3576 wrote to memory of 5048	3576	svchost.exe	96
PID 3576 wrote to memory of 5048	3576	svchost.exe	96
PID 4912 wrote to memory of 2272	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	99
PID 4912 wrote to memory of 2272	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	99
PID 4912 wrote to memory of 2272	4912	neas.13d37451cb332802b88bd5684f8a9f90.exe	99
PID 2272 wrote to memory of 772	2272	cmd.exe	102
PID 2272 wrote to memory of 772	2272	cmd.exe	102
PID 2272 wrote to memory of 772	2272	cmd.exe	102
PID 4740 wrote to memory of 4860	4740	UPUGVT.exe	101
PID 4740 wrote to memory of 4860	4740	UPUGVT.exe	101
PID 4740 wrote to memory of 2092	4740	UPUGVT.exe	104
PID 4740 wrote to memory of 2092	4740	UPUGVT.exe	104
PID 4740 wrote to memory of 2092	4740	UPUGVT.exe	104
PID 2092 wrote to memory of 4980	2092	icsys.icn.exe	105
PID 2092 wrote to memory of 4980	2092	icsys.icn.exe	105
PID 2092 wrote to memory of 4980	2092	icsys.icn.exe	105

C:\Users\Admin\AppData\Local\Temp\NEAS.13d37451cb332802b88bd5684f8a9f90.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.13d37451cb332802b88bd5684f8a9f90.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- \??\c:\users\admin\appdata\local\temp\neas.13d37451cb332802b88bd5684f8a9f90.exe
  c:\users\admin\appdata\local\temp\neas.13d37451cb332802b88bd5684f8a9f90.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\UPUGVT.exe
    "C:\Users\Admin\AppData\Local\Temp\UPUGVT.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - \??\c:\users\admin\appdata\local\temp\upugvt.exe
      c:\users\admin\appdata\local\temp\upugvt.exe
      4⤵
      Executes dropped EXE
      PID:4860
  - - C:\Users\Admin\AppData\Local\icsys.icn.exe
      C:\Users\Admin\AppData\Local\icsys.icn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2092
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
- - C:\Users\Admin\AppData\Local\Temp\RXLFSQ.exe
    "C:\Users\Admin\AppData\Local\Temp\RXLFSQ.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:1048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 2456
      4⤵
      Program crash
      PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn CIJRTX.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn CIJRTX.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
      4⤵
      Creates scheduled task(s)
      PID:772
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1744
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visiblity of hidden/system files in Explorer
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3068
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3576
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Windows\SysWOW64\at.exe
        
        at 04:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:5048

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1048 -ip 1048
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RXLFSQ.exe

Filesize
85KB

MD5
1963215be5bef2cc0b8786057b2f406e

SHA1
66b0cff746baa348719eab2508e4b7ccba75e335

SHA256
d50bc227c8e0c573daca7291d9f684a9626e6274aa4e08f778f7cc2aa9eb57b0

SHA512
e3c88d1ad4bf9593519ee7cde1a784c14ab5c15784e2c49e35454df3280dd638f068d28989af9f953cce955a4452de38baf9883070de66a2fad488524a038ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RXLFSQ.exe

Filesize
85KB

MD5
1963215be5bef2cc0b8786057b2f406e

SHA1
66b0cff746baa348719eab2508e4b7ccba75e335

SHA256
d50bc227c8e0c573daca7291d9f684a9626e6274aa4e08f778f7cc2aa9eb57b0

SHA512
e3c88d1ad4bf9593519ee7cde1a784c14ab5c15784e2c49e35454df3280dd638f068d28989af9f953cce955a4452de38baf9883070de66a2fad488524a038ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RXLFSQ.exe

Filesize
85KB

MD5
1963215be5bef2cc0b8786057b2f406e

SHA1
66b0cff746baa348719eab2508e4b7ccba75e335

SHA256
d50bc227c8e0c573daca7291d9f684a9626e6274aa4e08f778f7cc2aa9eb57b0

SHA512
e3c88d1ad4bf9593519ee7cde1a784c14ab5c15784e2c49e35454df3280dd638f068d28989af9f953cce955a4452de38baf9883070de66a2fad488524a038ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPUGVT.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPUGVT.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\neas.13d37451cb332802b88bd5684f8a9f90.exe

Filesize
4.4MB

MD5
4ef9093c4d69f66d224b6734abc50345

SHA1
ac7e66abb63ef71d14a7753d769379ec7ee5eb5e

SHA256
a7d420fbd384b07ca436d9a48f2975f5401fd4efb16445bff7a0d2ffba53dcfa

SHA512
dddc114583045a49e0e9757f5dac6bcd517bd5b577501d84f5d750944206e3c376c7db37914fa6f3cc216a3442078d2b64109004aee4a82f8a7f1154423f8732

Download Submit
C:\Users\Admin\AppData\Local\Temp\upugvt.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
97968fd70aa980e0f26118b2fe567364

SHA1
c698ef8de25dc4e8c311cc64fd65875ed54b421d

SHA256
60790ecc8c9eeebce2a76e408d6cbcfb37e39e0bb9ab7b9eb1212dd586a505de

SHA512
3b1a501d30e5bc773c029d9707a3553c9f8c401291a98c4df7006eed078bfae0318a0b71e2b60a1ff2bf80ae52df0d0d0cc5ca3cbf4b4d4acb385934ddd3a5d0

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
97968fd70aa980e0f26118b2fe567364

SHA1
c698ef8de25dc4e8c311cc64fd65875ed54b421d

SHA256
60790ecc8c9eeebce2a76e408d6cbcfb37e39e0bb9ab7b9eb1212dd586a505de

SHA512
3b1a501d30e5bc773c029d9707a3553c9f8c401291a98c4df7006eed078bfae0318a0b71e2b60a1ff2bf80ae52df0d0d0cc5ca3cbf4b4d4acb385934ddd3a5d0

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
97968fd70aa980e0f26118b2fe567364

SHA1
c698ef8de25dc4e8c311cc64fd65875ed54b421d

SHA256
60790ecc8c9eeebce2a76e408d6cbcfb37e39e0bb9ab7b9eb1212dd586a505de

SHA512
3b1a501d30e5bc773c029d9707a3553c9f8c401291a98c4df7006eed078bfae0318a0b71e2b60a1ff2bf80ae52df0d0d0cc5ca3cbf4b4d4acb385934ddd3a5d0

Download Submit
C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe

Filesize
4.4MB

MD5
4ef9093c4d69f66d224b6734abc50345

SHA1
ac7e66abb63ef71d14a7753d769379ec7ee5eb5e

SHA256
a7d420fbd384b07ca436d9a48f2975f5401fd4efb16445bff7a0d2ffba53dcfa

SHA512
dddc114583045a49e0e9757f5dac6bcd517bd5b577501d84f5d750944206e3c376c7db37914fa6f3cc216a3442078d2b64109004aee4a82f8a7f1154423f8732

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
bb6c9a0bf73d3cd99b583f964d75c903

SHA1
799aa0bbeeb890425f39d0f8d79c2eaaf62fb3e1

SHA256
9a07461b797921320959cc75e38703d9ebf4bb933a0ad9b63d9fafb61edc67b6

SHA512
d6d32dc77ab3fd5b359154c86afbcfc4ccd68020758ae00e38052ce4223aa27d4ed50d608cc15e47c9cfdf9d80c3a8784fd0143b3dda52bf25d38e0412f8256c

Download Submit
C:\Windows\System\explorer.exe

Filesize
207KB

MD5
b480faf2d5ab0d383bd8448514efa86c

SHA1
018a433611fe2a92d8accd738a6ceb375ae03c7b

SHA256
a852a224e38c4a6534071ead1bc2d5f4ad14b4241c6d9905cc0b6ff9d856cbde

SHA512
d82d01996e96b5cc29829cc13169e4b210bbe67293d2509f00f84835139fe86a587a72ed01c2472e870b9ae62b41710beec3415d2ba7034e5ac97b92e517f4a5

Download Submit
C:\Windows\System\explorer.exe

Filesize
207KB

MD5
b480faf2d5ab0d383bd8448514efa86c

SHA1
018a433611fe2a92d8accd738a6ceb375ae03c7b

SHA256
a852a224e38c4a6534071ead1bc2d5f4ad14b4241c6d9905cc0b6ff9d856cbde

SHA512
d82d01996e96b5cc29829cc13169e4b210bbe67293d2509f00f84835139fe86a587a72ed01c2472e870b9ae62b41710beec3415d2ba7034e5ac97b92e517f4a5

Download Submit
C:\Windows\System\explorer.exe

Filesize
207KB

MD5
b480faf2d5ab0d383bd8448514efa86c

SHA1
018a433611fe2a92d8accd738a6ceb375ae03c7b

SHA256
a852a224e38c4a6534071ead1bc2d5f4ad14b4241c6d9905cc0b6ff9d856cbde

SHA512
d82d01996e96b5cc29829cc13169e4b210bbe67293d2509f00f84835139fe86a587a72ed01c2472e870b9ae62b41710beec3415d2ba7034e5ac97b92e517f4a5

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
224bdcff062e681c9bdd2ec4aeba37b9

SHA1
8e03753fcff609af166110c636fea9a6374efee6

SHA256
f537f0a020b7eda0d81d74181db72e8cdfd13b97d5a5db153f2d08ac02289c23

SHA512
5acde589a32f1339eff4a4a0dc947362370c0b3571502c74d5d1ba5a1f9a776ce40b43234354bb8fef314a4bca057608de67b95479f9e6ee3769602e0c3746c6

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
224bdcff062e681c9bdd2ec4aeba37b9

SHA1
8e03753fcff609af166110c636fea9a6374efee6

SHA256
f537f0a020b7eda0d81d74181db72e8cdfd13b97d5a5db153f2d08ac02289c23

SHA512
5acde589a32f1339eff4a4a0dc947362370c0b3571502c74d5d1ba5a1f9a776ce40b43234354bb8fef314a4bca057608de67b95479f9e6ee3769602e0c3746c6

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
98e9f4032533b2a3f77743bc147b3c60

SHA1
20a5186ee2787a253d3749017f50f150ce334488

SHA256
fc6ffab3c03d3f827f897dc8294f76c676271def040ef2cceb69d75aba202a4d

SHA512
c7ce89c16134eb373728fc1f84175b1cb15df090ec45c34576095c52b1a98555952eb2b3725fb7d72090740834b654fef47050dc9af3b99e443de2d3efd448be

Download Submit
\??\c:\users\admin\appdata\local\temp\neas.13d37451cb332802b88bd5684f8a9f90.exe

Filesize
4.4MB

MD5
4ef9093c4d69f66d224b6734abc50345

SHA1
ac7e66abb63ef71d14a7753d769379ec7ee5eb5e

SHA256
a7d420fbd384b07ca436d9a48f2975f5401fd4efb16445bff7a0d2ffba53dcfa

SHA512
dddc114583045a49e0e9757f5dac6bcd517bd5b577501d84f5d750944206e3c376c7db37914fa6f3cc216a3442078d2b64109004aee4a82f8a7f1154423f8732

Download Submit
\??\c:\users\admin\appdata\local\temp\upugvt.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
207KB

MD5
b480faf2d5ab0d383bd8448514efa86c

SHA1
018a433611fe2a92d8accd738a6ceb375ae03c7b

SHA256
a852a224e38c4a6534071ead1bc2d5f4ad14b4241c6d9905cc0b6ff9d856cbde

SHA512
d82d01996e96b5cc29829cc13169e4b210bbe67293d2509f00f84835139fe86a587a72ed01c2472e870b9ae62b41710beec3415d2ba7034e5ac97b92e517f4a5

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
224bdcff062e681c9bdd2ec4aeba37b9

SHA1
8e03753fcff609af166110c636fea9a6374efee6

SHA256
f537f0a020b7eda0d81d74181db72e8cdfd13b97d5a5db153f2d08ac02289c23

SHA512
5acde589a32f1339eff4a4a0dc947362370c0b3571502c74d5d1ba5a1f9a776ce40b43234354bb8fef314a4bca057608de67b95479f9e6ee3769602e0c3746c6

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
98e9f4032533b2a3f77743bc147b3c60

SHA1
20a5186ee2787a253d3749017f50f150ce334488

SHA256
fc6ffab3c03d3f827f897dc8294f76c676271def040ef2cceb69d75aba202a4d

SHA512
c7ce89c16134eb373728fc1f84175b1cb15df090ec45c34576095c52b1a98555952eb2b3725fb7d72090740834b654fef47050dc9af3b99e443de2d3efd448be

Download Submit
memory/1048-104-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1048-103-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1048-109-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1048-108-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1048-107-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1048-72-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1048-106-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1048-105-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1048-76-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1256-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1256-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1744-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2092-102-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2092-92-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3068-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4740-100-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4740-61-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-101-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download