Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 20:15
Behavioral task
behavioral1
Sample
NEAS.d46f22ae2fccf6d1536c5719fb146230.exe
Resource
win7-20231020-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.d46f22ae2fccf6d1536c5719fb146230.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
NEAS.d46f22ae2fccf6d1536c5719fb146230.exe
-
Size
6.2MB
-
MD5
d46f22ae2fccf6d1536c5719fb146230
-
SHA1
77b03556299409144e0de1a89d8cb67d922c83a3
-
SHA256
47953064445247d84e441d997293cee164dd14f8d76044ccaf5b5be26a2c8083
-
SHA512
502709425e22ecb8560696aaa53aac0e50c983678ebc70e1e40c8b7eba18896e17eceba33b806a715faa0e134567854704be45b5906a9ef2d5701e51d8d5a8bc
-
SSDEEP
196608:Ub3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mIb1z6e:Ub3bPk5HPhJCIbse
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2880-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2880-2-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000100000000ea77-6.dat upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskpart.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\driverquery.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\fc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\fltMC.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\ndadmin.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\PING.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\tracerpt.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\comp.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\dxdiag.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\getmac.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\net.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\openfiles.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\PkgMgr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\takeown.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\wecutil.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDADM.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\ntprint.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\tcmsetup.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\wsmprovhost.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\unlodctr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\cscript.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\dllhost.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\drvinst.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\extrac32.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\mmc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\msinfo32.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\RpcPing.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\DpiScaling.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\eudcedit.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\upnpcont.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\compact.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\dllhst3g.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\iexpress.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\w32tm.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\at.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\chkntfs.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\dfrgui.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\wextract.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\sethc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\wiaacmgr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\cliconfg.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\dplaysvr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\netbtugc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\write.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\replace.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\whoami.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\certreq.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\explorer.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\logman.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\Netplwiz.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\PushPrinterConnections.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\SysWOW64\RmClient.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_cb604f1aa758e6b6\IMJPMGR.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_d9c7c4a2e721da7e\dpapimig.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_c9392808773cd7da\cleanmgr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\ditrace.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPUEX.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_c10c2a29895d4994\gpscript.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPDCT.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a\winload.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\dpnsvr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_5a9496fc0f35b80b\DWWIN.EXE NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_95955bd51390781b\ehshell.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7601.17514_none_1b8f8373383de46a\ehrecvr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_ce2d22115368db7a\WerFaultSecure.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\ehome\mcspad.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_244ae8599e6d81bb\hh.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_fbcfa2528586252f\credwiz.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-wtvconverter_31bf3856ad364e35_6.1.7600.16385_none_a8464accb5a91f59\WTVConverter.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_371e8c461d966a55\extrac32.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_b1186146f739d0f1\forfiles.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\servicing\GC64\tzupd.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_infocard_b77a5c561934e089_6.1.7601.17514_none_583a8c60c0b305a1\infocard.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a\winresume.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\hh.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcalua.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-deployment_31bf3856ad364e35_6.1.7600.16385_none_57e3e87206ff08ca\setupugc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diskpart_31bf3856ad364e35_6.1.7601.17514_none_c6fe6ac9ac8c7105\diskpart.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\ehome\WTVConverter.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17932_none_d26a33ec18cb49c4\conhost.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_6.1.7600.16385_none_e3aea9874278550c\cofire.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\ehome\ehprivjob.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\servicing\TrustedInstaller.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winhlp32.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehsched_31bf3856ad364e35_6.1.7600.16385_none_0167f08155bf1c81\ehsched.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_mcupdate_31bf3856ad364e35_6.1.7601.17514_none_26c2d72ec26de8d9\mcupdate.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\bfsvc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\ehome\McrMgr.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7601.17514_none_d4c5c995fb3f4a1b\audiodg.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_ba9e94bf275d71ed\Dism.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-alg_31bf3856ad364e35_6.1.7600.16385_none_04de43c774cf8fe3\alg.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_626b9352dcfa715c\ComputerDefaults.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe NEAS.d46f22ae2fccf6d1536c5719fb146230.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.3MB
MD50b8752ac07c4435f48653dcc437164d8
SHA176add172cff7ce142045d194c756c48e3ace8c6d
SHA256e561fc56edfa8b898c0c1e426d61e2c256e4f9869712dd2f071255289f087073
SHA512e0d0cc32db180373638b04e75cad507f6921b586f9cd184fb875ebc44d63c5bbe49b188b0639f40b4d6f7ece386618d14f01c7179adb774b218c94f6dfa35bd3