dee588faaa4f82ee52560d2718bbcfdee779e4e5361565471fffebead7bbf026

Analysis

max time kernel
25s
max time network
17s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4d2b8713150950ac7d0e299721101560.exe
Size

1.1MB
MD5

4d2b8713150950ac7d0e299721101560
SHA1

e35da256fa3d8460b74c0063be4fc78879bddbce
SHA256

dee588faaa4f82ee52560d2718bbcfdee779e4e5361565471fffebead7bbf026
SHA512

06bb9fd92ba4158d951315421df7bcde459e386dcc7affa1b206ccec252b38c2f7c43ad423c0f4cb0f1f30bd76a0acb00add05cc743f2a4d41644bb786bdcbeb
SSDEEP

24576:ZVXsFW5X8JCVMW+X3bnD8LHgZSJ873huT2rr6LzLBZ:ZVXplyW2rnD8LHHJ8zhuersLz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	9212.tmp

Loads dropped DLL 2 IoCs

pid	Process
3068	NEAS.4d2b8713150950ac7d0e299721101560.exe
3068	NEAS.4d2b8713150950ac7d0e299721101560.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.sfx	9212.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	9212.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1720	3068	NEAS.4d2b8713150950ac7d0e299721101560.exe	28
PID 3068 wrote to memory of 1720	3068	NEAS.4d2b8713150950ac7d0e299721101560.exe	28
PID 3068 wrote to memory of 1720	3068	NEAS.4d2b8713150950ac7d0e299721101560.exe	28
PID 3068 wrote to memory of 1720	3068	NEAS.4d2b8713150950ac7d0e299721101560.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.4d2b8713150950ac7d0e299721101560.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4d2b8713150950ac7d0e299721101560.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\9212.tmp
  C:\Users\Admin\AppData\Local\Temp\9212.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9212.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\9212.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\9212.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\9212.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
\Users\Admin\AppData\Local\Temp\9212.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/3068-0-0x0000000000300000-0x000000000034E000-memory.dmp

Filesize
312KB

Download
memory/3068-1-0x0000000000300000-0x000000000034E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads