Analysis
-
max time kernel
134s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
31/10/2023, 23:49
General
-
Target
NEAS.6848d5d67a05a2f454fd71ab9e7cf480.exe
-
Size
233KB
-
MD5
6848d5d67a05a2f454fd71ab9e7cf480
-
SHA1
1585e1cbdcd3d05c04e2328c8175f5d83ed640c3
-
SHA256
6434d7c711f63e76325410d5a1849bd9d5bf4626e7e07eb0d772b31acc655a1e
-
SHA512
99b712ab4d324082d3ca4b3bc880d763e0f64c223a9ef95b13c2c23ff10a192933665dd5074375acb862bf87205a822e2b8578cf63a3e68303a5107dccfc03e9
-
SSDEEP
3072:6e7WpUV2x7L+4XGH3XGkR2SRXGkR2SnbZmZRN2jN212R2HI9D3N0NGCLOwstyhZC:RqpMH5ZmZ/2R2o9rN4ShcHUa2
Malware Config
Signatures
-
Renames multiple (635) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6848d5d67a05a2f454fd71ab9e7cf480.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6848d5d67a05a2f454fd71ab9e7cf480.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Users\Admin\AppData\Local\Temp\_cpush.exe"_cpush.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5c5f642a31b1f8f1ea4c1165ce0f63f92
SHA10d03cc89e08c1899eefc8eafd53e7b4595d7fd6e
SHA2562839d95d709c77e7db0540bc9d11db21727f955baf1020b5859aab736d20f3fb
SHA5129aef9ff8fd210c7f29a7709f241d1bc43bfb5f6c1da793f7d780629ee9cc29bf64a78eebbb74ae67b0b8ef8cfe20b517aa7ceb745caedaf9ed7b39e8dedcf8a0
-
Filesize
93KB
MD5c5f642a31b1f8f1ea4c1165ce0f63f92
SHA10d03cc89e08c1899eefc8eafd53e7b4595d7fd6e
SHA2562839d95d709c77e7db0540bc9d11db21727f955baf1020b5859aab736d20f3fb
SHA5129aef9ff8fd210c7f29a7709f241d1bc43bfb5f6c1da793f7d780629ee9cc29bf64a78eebbb74ae67b0b8ef8cfe20b517aa7ceb745caedaf9ed7b39e8dedcf8a0
-
Filesize
140KB
MD51793928d1c8daf03a8b67a60a0ffbd93
SHA1c777c5be2321bf493877efef590eec8c822e2072
SHA25684a2bb3191f370ba456dd8637e08cd47ef1c80a54d081881cd1e16a8c67f0238
SHA51264ef94fb34b637c5d40878f4d3b0db7f2d74e89be35fca959ee9354cdf8f5bd61d90e8aa1ff795ddafe60ba5d1a0d4b57c41b1bf8750d24d685aa98f4142c11a
-
Filesize
140KB
MD51793928d1c8daf03a8b67a60a0ffbd93
SHA1c777c5be2321bf493877efef590eec8c822e2072
SHA25684a2bb3191f370ba456dd8637e08cd47ef1c80a54d081881cd1e16a8c67f0238
SHA51264ef94fb34b637c5d40878f4d3b0db7f2d74e89be35fca959ee9354cdf8f5bd61d90e8aa1ff795ddafe60ba5d1a0d4b57c41b1bf8750d24d685aa98f4142c11a
-
Filesize
92KB
MD5b70a5b1435b9687520df9d6340016755
SHA1b035050a5133eade208ac4cb77d52849ebe70153
SHA256a713f47befe287affd05649035a75691f593918d9cbb38005658d446c4596151
SHA5121a69dfd2dd91fd8b8b7d246581e11ddfe055b3b219ff174c4db0265cefc1ce61afe84275b72b77abec026214f46db821a064e9b726ed32b521731d3fa959b622
-
Filesize
92KB
MD5b70a5b1435b9687520df9d6340016755
SHA1b035050a5133eade208ac4cb77d52849ebe70153
SHA256a713f47befe287affd05649035a75691f593918d9cbb38005658d446c4596151
SHA5121a69dfd2dd91fd8b8b7d246581e11ddfe055b3b219ff174c4db0265cefc1ce61afe84275b72b77abec026214f46db821a064e9b726ed32b521731d3fa959b622
-
Filesize
160KB
-
Filesize
10.8MB
-
Filesize
10.8MB