Analysis
-
max time kernel
123s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 19:58
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a0c8b556a59d0cf9a69a4e99bb545c10.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.a0c8b556a59d0cf9a69a4e99bb545c10.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.a0c8b556a59d0cf9a69a4e99bb545c10.exe
-
Size
8.9MB
-
MD5
a0c8b556a59d0cf9a69a4e99bb545c10
-
SHA1
e55881f7523428b63674ffc6841de2e6b25a7d32
-
SHA256
d035131d83f6b4b99abc7c048df6dafa7971a320ff665ed75ca8061aeff52149
-
SHA512
d20023339f3ea75431b89ac74c78f633cfb191b22134e4b876475df2e5a82ac12eb7ea9b8fd46d49ab917ca1b472a3c32561138fc79f07f5a7909c0807364b01
-
SSDEEP
98304:nllllllllllllllllllllllllllllllllllllllH:D
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3084 svrwsc.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe NEAS.a0c8b556a59d0cf9a69a4e99bb545c10.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a0c8b556a59d0cf9a69a4e99bb545c10.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a0c8b556a59d0cf9a69a4e99bb545c10.exe"1⤵
- Drops file in System32 directory
PID:3944
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3084
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.2MB
MD521d09ef5a86025ef45664b6d304ce3dc
SHA1d71c353a3c23e96ddd200de4b7dfc8cfc64142a0
SHA25618c92d9fcdcabcb5b8639a98d4002adf5575fae9489a5fd6fe38193743db1f10
SHA51209625e534aa11ada51b1fe0b4c31188b6c09fa4a48b2420c6eabee90bd82d1c93cb74511e394cbf1c29d0db8343d50d60695b04a7b95b805f96276b9c77401cb
-
Filesize
9.2MB
MD521d09ef5a86025ef45664b6d304ce3dc
SHA1d71c353a3c23e96ddd200de4b7dfc8cfc64142a0
SHA25618c92d9fcdcabcb5b8639a98d4002adf5575fae9489a5fd6fe38193743db1f10
SHA51209625e534aa11ada51b1fe0b4c31188b6c09fa4a48b2420c6eabee90bd82d1c93cb74511e394cbf1c29d0db8343d50d60695b04a7b95b805f96276b9c77401cb