9045f225574c183a231f07478f274c4595e923364e6bc16c3a938e694449c7c9 | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 17:22

Sharing

Report Analysis Logs

General

Target

NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe
Size

6.7MB
MD5

7bebd8cb62188ff993fd32e5f6c1d970
SHA1

3c4db4dd8eaba1601c253dcc4f7de8524dafbbcb
SHA256

9045f225574c183a231f07478f274c4595e923364e6bc16c3a938e694449c7c9
SHA512

05a4b8f7ed2effb7e0c3cbfda75673f9f748090480ae6c68d7bbf425ce75ea57b1b001c555250180bd425e93a0a8aaf9ca8c58956973b0cdaa86094d98ee2f24
SSDEEP

196608:Ub3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mIb1z8w:Ub3bPk5HPhJCIb

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/216-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/216-2-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regedit.exe	NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Boot\PCAT\memtest.exe	NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe
File created	C:\Windows\explorer.exe	NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe
File created	C:\Windows\HelpPane.exe	NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe
File created	C:\Windows\hh.exe	NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe
File created	C:\Windows\notepad.exe	NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe
File created	C:\Windows\bfsvc.exe	NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7bebd8cb62188ff993fd32e5f6c1d970.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/216-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download