Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 08:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.e6799ba673932fb8f8c5748effc0f75b.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.e6799ba673932fb8f8c5748effc0f75b.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.e6799ba673932fb8f8c5748effc0f75b.exe
-
Size
3.0MB
-
MD5
e6799ba673932fb8f8c5748effc0f75b
-
SHA1
90d0f7e4ab6f4914f661425f4a62f5bb9de713ac
-
SHA256
952453b000a9b232f660fcb9b84b6e9832e0aba5fc8f4a33fd5032654beb58ce
-
SHA512
963e6ca061fcb3d9179ac03f782c5eb5fe13135cf2af771bc252d39ffd12b7e5674563891eb78d5ed0e6fdf1fc43b6d42c8676d9c42051b76a1626e4d2985c2b
-
SSDEEP
49152:pZINO9Wp5UON4jvCh90mLI5TbMtjmUL0kpj7bmZfUQmcZY6sKsir3sdj8PjhROXN:v5y3KDI9pKALo5UnENsKsiQ6NJs
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" NEAS.e6799ba673932fb8f8c5748effc0f75b.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sIRC4.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\MavInject32.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MavInject32.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD73A.tmp NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD448.tmp NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD798.tmp NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD63E.tmp NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD67D.tmp NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD5C0.tmp NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe NEAS.e6799ba673932fb8f8c5748effc0f75b.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD58f9edb00cab08da34782ed7bf614ec0b
SHA12ccefe10f1ea23736c7cfbab1b9a7f61155114e3
SHA25642f91bf65c805e43eddf8bf9c0cad10acd936ecfaae72e2aaa918f4c9f136739
SHA512e1a4fbb8adc4be194797208a36d56ee9d2e69486c6b76c9d879d5b8d1420b8517b60dc361701b9198e565495cb558ffda871bce65b854e6d46b19f1225638fff