Overview

overview

7

Static

static

7

NEAS.c3188...e0.exe

windows7-x64

7

NEAS.c3188...e0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    218s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2023, 20:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.c31887ba20b949c0377d8a01b644cae0.exe

  • Size

    1.5MB

  • MD5

    c31887ba20b949c0377d8a01b644cae0

  • SHA1

    ab029f86f16463cbdf1f0de72c4fa2b5313c9388

  • SHA256

    4839a21320ec1d3d3cac26cfdba91d0c1ad3978f625a2b7084cc245d06b290e4

  • SHA512

    02d5a55d998d78f125dcbb148a98231893061198d3badf76ec5f7813c90ad95e61234260486e5c8bac8e8576ea1c65b736233a5ee22a10bf12000ebea992e316

  • SSDEEP

    24576:bu6J33O0c+JY5UZ+XC0kGsoKrLkTdNaPymUi63i62xHLVFYX0/WYZR:Vu0c++OCvkGslrLkpNufT5LVm0OYj

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.c31887ba20b949c0377d8a01b644cae0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c31887ba20b949c0377d8a01b644cae0.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1116

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1116-0-0x0000000000AD0000-0x0000000000C6F000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/1116-1-0x0000000000AD0000-0x0000000000C6F000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/1116-4-0x0000000000AD0000-0x0000000000C6F000-memory.dmp

          Filesize

          1.6MB

          Download