823a3ff1a6b1aa736615f7fbe782ba361ef07714eb90ad0c6bee810590c80a31

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
28/10/2023, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe
Size

1.1MB
MD5

9d75d232d6aea17af31b3a7aa0c7c740
SHA1

4da464f7cda6eaf7bddbd31b6ddc983e6da672d1
SHA256

823a3ff1a6b1aa736615f7fbe782ba361ef07714eb90ad0c6bee810590c80a31
SHA512

c24ce1ea78f5ea334089c45b9d0751d7a3f0446a045ea9605979b62c586f48258ec55e68b487d937f3ff8ef2d74bd71f3d45428559c07c7cea08f22f1fec0428
SSDEEP

24576:la8tuMeqzKyREnbPbMfXT8FqBYhGNtmWp40g6TyAEK6l1kZRHCJjn/v/XeyMFyHs:nF3EDqXYFqBYhGNtmWp40gBAEK6kDiV+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2364	svchost.exe
2076	NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe
2704	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	svchost.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2364	2220	NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe	28
PID 2220 wrote to memory of 2364	2220	NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe	28
PID 2220 wrote to memory of 2364	2220	NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe	28
PID 2220 wrote to memory of 2364	2220	NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe	28
PID 2364 wrote to memory of 2076	2364	svchost.exe	29
PID 2364 wrote to memory of 2076	2364	svchost.exe	29
PID 2364 wrote to memory of 2076	2364	svchost.exe	29
PID 2364 wrote to memory of 2076	2364	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe"
    3⤵
    - Executes dropped EXE
    PID:2076

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe

Filesize
1.1MB

MD5
011afe455561f2524e43fa0a87a6f59c

SHA1
216920c7193eaf81bb06ca34abed200a9be79b26

SHA256
09e5270cc0cf6bcd071e527e1e03b4f1ab1479b02fefcb32630130b6f05b566f

SHA512
e5e8cf564df30ab09133b8f1d7da80234c5be11184a768ffff7c305b38f5871d08d5384841129db0db93269a6b0000a22c09676847a02316b803b1db3d3b42ff

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.9d75d232d6aea17af31b3a7aa0c7c740.exe

Filesize
1.1MB

MD5
011afe455561f2524e43fa0a87a6f59c

SHA1
216920c7193eaf81bb06ca34abed200a9be79b26

SHA256
09e5270cc0cf6bcd071e527e1e03b4f1ab1479b02fefcb32630130b6f05b566f

SHA512
e5e8cf564df30ab09133b8f1d7da80234c5be11184a768ffff7c305b38f5871d08d5384841129db0db93269a6b0000a22c09676847a02316b803b1db3d3b42ff

Download Submit
memory/2220-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2364-15-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2704-18-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2704-28-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2704-31-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download