Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 19:54
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5f65626534da39a0c0ad5cd15a760d90.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.5f65626534da39a0c0ad5cd15a760d90.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.5f65626534da39a0c0ad5cd15a760d90.exe
-
Size
885KB
-
MD5
5f65626534da39a0c0ad5cd15a760d90
-
SHA1
6ab0542a76d0b7ecea8b2ff5f4e76a0a0f8205a3
-
SHA256
4464a77c53c1f590094cd04c3d1e750011bfeca4da0331fb06bbd3b8aba3f7da
-
SHA512
bc09467a85aae09fe1da841f578d8e404e63eeb8a3dba38f5bb561851c3112da1b89dc55ba6d45a8e6741ad8e3f9a4eed8ca594e7bbc7249d87ee7aea76e22a7
-
SSDEEP
12288:DRcljBvw0GKoScY80H80EYypQJTrNjnuLqaMUkV9kZAtq6ajTSLXPieUaRfg9gOl:DRcZ7yr/QuceLz9zCWmXI2P0QKa/ZSj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3056 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe -
Loads dropped DLL 1 IoCs
pid Process 2588 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3056 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2588 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3056 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3056 2588 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe 29 PID 2588 wrote to memory of 3056 2588 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe 29 PID 2588 wrote to memory of 3056 2588 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe 29 PID 2588 wrote to memory of 3056 2588 NEAS.5f65626534da39a0c0ad5cd15a760d90.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5f65626534da39a0c0ad5cd15a760d90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5f65626534da39a0c0ad5cd15a760d90.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\NEAS.5f65626534da39a0c0ad5cd15a760d90.exeC:\Users\Admin\AppData\Local\Temp\NEAS.5f65626534da39a0c0ad5cd15a760d90.exe2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
885KB
MD529a2ddd5049bc40ce4b087f584b4fb32
SHA18ef0a9c77bb4953985b48ad49392d354e365fee8
SHA2567ee22d3df3ce40edfc1f55d6ba310b750f43f628c27c9093565cf2babf19077c
SHA512deb7c91346132348b308b3b537772aae88d3037e142fdcaea0d0cfe45cf4494f8d06b33bbd12f4decd42e152d5448fe7d5e35810f549aac310a235d600353dd3
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
885KB
MD529a2ddd5049bc40ce4b087f584b4fb32
SHA18ef0a9c77bb4953985b48ad49392d354e365fee8
SHA2567ee22d3df3ce40edfc1f55d6ba310b750f43f628c27c9093565cf2babf19077c
SHA512deb7c91346132348b308b3b537772aae88d3037e142fdcaea0d0cfe45cf4494f8d06b33bbd12f4decd42e152d5448fe7d5e35810f549aac310a235d600353dd3