2cdb3abd3bf977b26849de716bb4f3340eeed12a992a7d6e0cc74f78cc3d6bf6

Analysis

max time kernel
129s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2023 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.cb551aea7604912ae12b90fed11d0f50.exe
Size

256KB
MD5

cb551aea7604912ae12b90fed11d0f50
SHA1

1bbf3db9ab6ba457ddcecadaade5fcbec6e42295
SHA256

2cdb3abd3bf977b26849de716bb4f3340eeed12a992a7d6e0cc74f78cc3d6bf6
SHA512

1e340cea6606bf26ab687a864e47c55dc110315cf985baaf7ecd1731ad8f3749fb5009bce7c3f598f4e501d8cdd813c039b6bbeeb3a7ac9bf32809073029dce1
SSDEEP

6144:czkbguXuWgKVtxel9WhgtsnfGfogKVtxel9WhgQ:c6guhM2+sMQ

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	NEAS.cb551aea7604912ae12b90fed11d0f50.exe

Executes dropped EXE 1 IoCs

pid	Process
780	Ldikgdpe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ldikgdpe.exe	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
File opened for modification	C:\Windows\SysWOW64\Ldikgdpe.exe	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
File created	C:\Windows\SysWOW64\Bekdaogi.dll	NEAS.cb551aea7604912ae12b90fed11d0f50.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3312	780	WerFault.exe	89
2240	780	WerFault.exe	89

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bekdaogi.dll"	NEAS.cb551aea7604912ae12b90fed11d0f50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	NEAS.cb551aea7604912ae12b90fed11d0f50.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 780	1468	NEAS.cb551aea7604912ae12b90fed11d0f50.exe	89
PID 1468 wrote to memory of 780	1468	NEAS.cb551aea7604912ae12b90fed11d0f50.exe	89
PID 1468 wrote to memory of 780	1468	NEAS.cb551aea7604912ae12b90fed11d0f50.exe	89
PID 780 wrote to memory of 3312	780	Ldikgdpe.exe	93
PID 780 wrote to memory of 3312	780	Ldikgdpe.exe	93
PID 780 wrote to memory of 3312	780	Ldikgdpe.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.cb551aea7604912ae12b90fed11d0f50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cb551aea7604912ae12b90fed11d0f50.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\Ldikgdpe.exe
  C:\Windows\system32\Ldikgdpe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 408
    3⤵
    - Program crash
    PID:3312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 408
    3⤵
    - Program crash
    PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 780 -ip 780
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ldikgdpe.exe

Filesize
256KB

MD5
2fff3d6e1aef31f27c741717a4f59616

SHA1
54711eda00976cb1c500f38528cf173cd4c4a6ac

SHA256
22ed66130758322b77a06916af8fdd4dfbc289ab83084d519de5b59f4b329122

SHA512
9bf545e419673879b0019c30a2285d56361d942d8429a0276ebed19fe1a9b5f78afcd071f261c2a29691198905c5e43803e926534b560f1af64a604849b8c550

Download Submit
C:\Windows\SysWOW64\Ldikgdpe.exe

Filesize
256KB

MD5
2fff3d6e1aef31f27c741717a4f59616

SHA1
54711eda00976cb1c500f38528cf173cd4c4a6ac

SHA256
22ed66130758322b77a06916af8fdd4dfbc289ab83084d519de5b59f4b329122

SHA512
9bf545e419673879b0019c30a2285d56361d942d8429a0276ebed19fe1a9b5f78afcd071f261c2a29691198905c5e43803e926534b560f1af64a604849b8c550

Download Submit
memory/780-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/780-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads