Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
23-10-2023 20:07
General
-
Target
NEAS.d25e8bd9849dc0ff1480b6a21df8c810_JC.exe
-
Size
395KB
-
MD5
d25e8bd9849dc0ff1480b6a21df8c810
-
SHA1
e0c0b59a7db31bdfaae0ca5f16271a60fca45bc9
-
SHA256
2bfef15bc1bb1f0e062d305309ab363693ada9ece4e2dfdbcd9a25b3e3ce4f2e
-
SHA512
91dfa4f3d45a1862531bf3f8e00f4e2d0d19129f095609d81399b99a96a99d81028ce09f82fa4747b732f8690e671cc00a9d08d7efcd642d5a69be6ae4f71af6
-
SSDEEP
6144:Hx+u5A7Mfqr3joHqqIJYaHlUAEgasjCNl8S0M7+Mgpjhb27/zxOPs:R+upqsHqqNI25g/jKuM5gpNS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Windows directory 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: MapViewOfSection 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-53076823-1954220958-1558946427823308727-1342384603-369351459-10926354301257626784"2⤵
-
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d25e8bd9849dc0ff1480b6a21df8c810_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d25e8bd9849dc0ff1480b6a21df8c810_JC.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysmgr.exe"C:\Windows\sysmgr.exe"3⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD52373dfbdba70b54164d4fe163f7f59f1
SHA1fbc51778f9e4868ddce4763d0bef4cb48090e3f6
SHA256e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456
SHA51232e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec
-
Filesize
2KB
MD5cc122d75c5811a9a402125ba0fd549f8
SHA1feace8ad120da38f2e19e5f503af6b75f77e2fc3
SHA2561a0742ce4833d7400459e8c5178f2c0c4112980316b444271c72c6fe480ca6a3
SHA512a8bdd97f342f2d1e4356a9cda2f1840daa5f18d414e6b715296c2972f4b25341786bccb1287b98bb34b893567fd8933b87e5c4359e1e72c55e9a191f542292be
-
Filesize
36KB
MD52373dfbdba70b54164d4fe163f7f59f1
SHA1fbc51778f9e4868ddce4763d0bef4cb48090e3f6
SHA256e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456
SHA51232e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec
-
Filesize
36KB
MD52373dfbdba70b54164d4fe163f7f59f1
SHA1fbc51778f9e4868ddce4763d0bef4cb48090e3f6
SHA256e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456
SHA51232e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
168KB
-
Filesize
168KB