b550cb0bb383ecbce2c59e41d75c6266bdef78a8ecc689c844107373c2f57a02

General

Target

NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe
Size

21KB
MD5

e7204f4106182ac4f1bec0975bf3c9b0
SHA1

2cc6f066ffef831faa839d2346f20ab5abafddbf
SHA256

b550cb0bb383ecbce2c59e41d75c6266bdef78a8ecc689c844107373c2f57a02
SHA512

905884b4b6e7b799d087ee4421d986b86850aaf68f2c9dd7f62b1e4a84f27f91ebfb94dce6c5256be394fbf3f44d09fc3a78cf1a05a44d18782abe9fda6f8a6c
SSDEEP

384:mEqabIvhj6tUhU2RDeQJ7PYrF8G8wARsh7h2h0amEd3JRxOLFh:m8IvfdRDVCF8GJAO1WRhJRxOLFh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2668	tazoihe.exe

Loads dropped DLL 2 IoCs

pid	Process
2660	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe
2660	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Run\daendu = "C:\\Users\\Admin\\tazoihe.exe"	tazoihe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\SystemCertificates\Xandom = 0ddfc7214566e0249658568229fc3a2e05f40b48eb622dd9a415d9cb5692300029000000ec07c9b60ae4b10502206a3a500c5ae24ed9169106d2bf6a04000000ec22f374c00ebf08	tazoihe.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\SystemCertificates\Xandom = 0ddfc7214566e0249758568229fc3a2e05f40b48eb622dd9a415d9cb5692300029000000ec07c9b60ae4b10502206a3a500c5ae24ed9169106d2bf6a04000000ec22f3744f806cc2	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2668	tazoihe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe
Token: SeDebugPrivilege	2668	tazoihe.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2668	2660	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe	28
PID 2660 wrote to memory of 2668	2660	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe	28
PID 2660 wrote to memory of 2668	2660	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe	28
PID 2660 wrote to memory of 2668	2660	NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe	28
PID 2668 wrote to memory of 1124	2668	tazoihe.exe	22
PID 2668 wrote to memory of 1124	2668	tazoihe.exe	22
PID 2668 wrote to memory of 1124	2668	tazoihe.exe	22

C:\Users\Admin\AppData\Local\Temp\NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e7204f4106182ac4f1bec0975bf3c9b0_JC.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\tazoihe.exe
  "C:\Users\Admin\tazoihe.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2668

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\tazoihe.exe

Filesize
21KB

MD5
4c0b5183c9da4888a2d41820c5e8a2ac

SHA1
37676e35f8260af207179fe297c4df0bad01f833

SHA256
f692070771044e9e29c30ad9b3b3d71df04ef665d82c995b395660639bb5e3ef

SHA512
087bacd39001411a73e1590cd7193097c433dd24bc8c637538c2490204bdf162078f28c851329f22772d40f1e4b90c308f2c08bf3eede64f99ef52f5aa90547a

Download Submit
C:\Users\Admin\tazoihe.exe

Filesize
21KB

MD5
4c0b5183c9da4888a2d41820c5e8a2ac

SHA1
37676e35f8260af207179fe297c4df0bad01f833

SHA256
f692070771044e9e29c30ad9b3b3d71df04ef665d82c995b395660639bb5e3ef

SHA512
087bacd39001411a73e1590cd7193097c433dd24bc8c637538c2490204bdf162078f28c851329f22772d40f1e4b90c308f2c08bf3eede64f99ef52f5aa90547a

Download Submit
\Users\Admin\tazoihe.exe

Filesize
21KB

MD5
4c0b5183c9da4888a2d41820c5e8a2ac

SHA1
37676e35f8260af207179fe297c4df0bad01f833

SHA256
f692070771044e9e29c30ad9b3b3d71df04ef665d82c995b395660639bb5e3ef

SHA512
087bacd39001411a73e1590cd7193097c433dd24bc8c637538c2490204bdf162078f28c851329f22772d40f1e4b90c308f2c08bf3eede64f99ef52f5aa90547a

Download Submit
\Users\Admin\tazoihe.exe

Filesize
21KB

MD5
4c0b5183c9da4888a2d41820c5e8a2ac

SHA1
37676e35f8260af207179fe297c4df0bad01f833

SHA256
f692070771044e9e29c30ad9b3b3d71df04ef665d82c995b395660639bb5e3ef

SHA512
087bacd39001411a73e1590cd7193097c433dd24bc8c637538c2490204bdf162078f28c851329f22772d40f1e4b90c308f2c08bf3eede64f99ef52f5aa90547a

Download Submit
memory/1124-14-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/1124-16-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/1124-17-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2660-0-0x0000000077160000-0x0000000077161000-memory.dmp

Filesize
4KB

Download
memory/2660-1-0x000000007715F000-0x0000000077160000-memory.dmp

Filesize
4KB

Download
memory/2660-2-0x000000007717C000-0x000000007717D000-memory.dmp

Filesize
4KB

Download
memory/2660-4-0x0000000075FE0000-0x00000000760F0000-memory.dmp

Filesize
1.1MB

Download
memory/2660-13-0x0000000075FE0000-0x00000000760F0000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads