0752357da2d80f4cd7123791eadab022e9396ef5213ae9da1a9202905fd61062

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2fc4e744f73a582cbdd2c13df9fc25c0.exe
Size

148KB
MD5

2fc4e744f73a582cbdd2c13df9fc25c0
SHA1

beebda2eb7f038e2ea313aebcc382bf42a119945
SHA256

0752357da2d80f4cd7123791eadab022e9396ef5213ae9da1a9202905fd61062
SHA512

f3c645b89ce50bb28dda3e799991b06f7d56db97d9a10ea9ec17ea92783d8c1c4c768fdcc20eab4677be7b751ac6abd7f4117807c519d29f8326d317ddd2896d
SSDEEP

3072:SZwhLsm0Mo2dDIpgwFdzk+I+oXzWe2/iBYiHvXG+gMvcahKX4A:SZwhBTpdDImk2+vC2/9UtvcvXx

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2564	zimfrwc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\zimfrwc.exe	NEAS.2fc4e744f73a582cbdd2c13df9fc25c0.exe
File created	C:\PROGRA~3\Mozilla\pjqvbbf.dll	zimfrwc.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1988	NEAS.2fc4e744f73a582cbdd2c13df9fc25c0.exe
2564	zimfrwc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2564	2824	taskeng.exe	31
PID 2824 wrote to memory of 2564	2824	taskeng.exe	31
PID 2824 wrote to memory of 2564	2824	taskeng.exe	31
PID 2824 wrote to memory of 2564	2824	taskeng.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.2fc4e744f73a582cbdd2c13df9fc25c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2fc4e744f73a582cbdd2c13df9fc25c0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1988

C:\Windows\system32\taskeng.exe
taskeng.exe {3B7D3EAD-F5DD-4B9C-BB61-6EE6A91E17AB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\PROGRA~3\Mozilla\zimfrwc.exe
  C:\PROGRA~3\Mozilla\zimfrwc.exe -gtjzibe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
148KB

MD5
0a5e033d28a9d5ece34d29e60df03b98

SHA1
858c0e1d7576d473909d21f6010b5f2cc26459ee

SHA256
08e0e954aa2058228dcff96ad9425db9babb4183398a7aa70e1ca082f89d2a16

SHA512
90ad6bbb07d3a940b956d41ac4ae4f16237cfbc33e8af9b4096093650ab13dcd705b6a8ae06739dfa5a60ca41aa476a5a1a7f27f8e6e1d319738cd68b69ebf34

Download Submit
C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
148KB

MD5
0a5e033d28a9d5ece34d29e60df03b98

SHA1
858c0e1d7576d473909d21f6010b5f2cc26459ee

SHA256
08e0e954aa2058228dcff96ad9425db9babb4183398a7aa70e1ca082f89d2a16

SHA512
90ad6bbb07d3a940b956d41ac4ae4f16237cfbc33e8af9b4096093650ab13dcd705b6a8ae06739dfa5a60ca41aa476a5a1a7f27f8e6e1d319738cd68b69ebf34

Download Submit
memory/1988-2-0x0000000000260000-0x00000000002BB000-memory.dmp

Filesize
364KB

Download
memory/1988-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1988-4-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1988-6-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1988-7-0x0000000000260000-0x00000000002BB000-memory.dmp

Filesize
364KB

Download
memory/1988-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1988-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1988-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1988-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2564-12-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2564-13-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-15-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download