Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
28/10/2023, 19:57
General
-
Target
NEAS.8e5a79ebca42afba1435da8c09d68c60.exe
-
Size
464KB
-
MD5
8e5a79ebca42afba1435da8c09d68c60
-
SHA1
ab4752b9b9b4cbc61745ef977da5d7a8f292ce9e
-
SHA256
1a57a6255e4296a9c19350e591dfe614b58ac8332156a5d5771aeb478c64e5db
-
SHA512
9b6cf459ab60a782557a35de2600ead5f3d5ec949c51b6f27e153a343f435a95f09252de45cbc14fb170fdcbdadae45da4d6573e9540b8947ec259e4d0235f66
-
SSDEEP
12288:DWlc87eqqV5e+wBV6O+ypunWt0AiDwju4zwPC:DWSqqHeVBxZpuW+Mhzt
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8e5a79ebca42afba1435da8c09d68c60.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8e5a79ebca42afba1435da8c09d68c60.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\certmsdt\findtmac.exe"C:\Users\Admin\AppData\Roaming\certmsdt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~8E17.tmp3200 475144 2812 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\caclimig.exeC:\Windows\SysWOW64\caclimig.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
464KB
MD54c26068f21d6da5ce08a352ef0d5ff9a
SHA1433c7d11d283f898f1dda52769e9106f5c32df7c
SHA256dd4d78a970265616b3b9e4da7eeaf16ef3f4f2908f46086c9b7a083170fb655f
SHA51243694265eee07c0689015a0162b7fae4c154c86d8658674265691a795af4fb5b25660c19bea17e87c3cc8163ffa5b95572b4955526f87069684eabef631fcb0e
-
Filesize
464KB
MD54c26068f21d6da5ce08a352ef0d5ff9a
SHA1433c7d11d283f898f1dda52769e9106f5c32df7c
SHA256dd4d78a970265616b3b9e4da7eeaf16ef3f4f2908f46086c9b7a083170fb655f
SHA51243694265eee07c0689015a0162b7fae4c154c86d8658674265691a795af4fb5b25660c19bea17e87c3cc8163ffa5b95572b4955526f87069684eabef631fcb0e
-
Filesize
464KB
MD54c26068f21d6da5ce08a352ef0d5ff9a
SHA1433c7d11d283f898f1dda52769e9106f5c32df7c
SHA256dd4d78a970265616b3b9e4da7eeaf16ef3f4f2908f46086c9b7a083170fb655f
SHA51243694265eee07c0689015a0162b7fae4c154c86d8658674265691a795af4fb5b25660c19bea17e87c3cc8163ffa5b95572b4955526f87069684eabef631fcb0e
-
Filesize
464KB
MD54c26068f21d6da5ce08a352ef0d5ff9a
SHA1433c7d11d283f898f1dda52769e9106f5c32df7c
SHA256dd4d78a970265616b3b9e4da7eeaf16ef3f4f2908f46086c9b7a083170fb655f
SHA51243694265eee07c0689015a0162b7fae4c154c86d8658674265691a795af4fb5b25660c19bea17e87c3cc8163ffa5b95572b4955526f87069684eabef631fcb0e
-
Filesize
500KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
500KB
-
Filesize
488KB
-
Filesize
20KB
-
Filesize
528KB
-
Filesize
24KB
-
Filesize
528KB
-
Filesize
52KB
-
Filesize
488KB
-
Filesize
500KB