2bdc5c641757c953df7f9413bffafd353e8a7ce5ca6a73f36a63987d00d2a184

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe
Size

29KB
MD5

2a73c178e22e9dcb51a3d540b62eb4c0
SHA1

b716bab8099ff6525787637a440dbfa75df0a6f8
SHA256

2bdc5c641757c953df7f9413bffafd353e8a7ce5ca6a73f36a63987d00d2a184
SHA512

fc5613011caff2166db4c09014e53508c5c6860c1731a7e2216606112b86f0f17fefc299cf97e58a5b2b15f7ccbf95a7fb7a4d5ff337152b8b6a15afcf49b0a5
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/m5:AEwVs+0jNDY1qi/qS

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3068	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/232-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0006000000022deb-4.dat	upx
behavioral2/files/0x0006000000022deb-7.dat	upx
behavioral2/memory/3068-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/232-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3068-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3068-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000c000000022cfe-65.dat	upx
behavioral2/memory/232-87-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3068-88-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/232-138-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3068-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/232-188-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3068-189-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/232-242-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3068-243-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe
File created	C:\Windows\services.exe	NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe
File opened for modification	C:\Windows\java.exe	NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3068	232	NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe	86
PID 232 wrote to memory of 3068	232	NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe	86
PID 232 wrote to memory of 3068	232	NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2a73c178e22e9dcb51a3d540b62eb4c0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\80UBY5GD\default[3].htm

Filesize
304B

MD5
605de1f61d0446f81e63c25750e99301

SHA1
0eaf9121f9dc1338807a511f92ea0b30dc2982a5

SHA256
049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

SHA512
a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F5C5X26J\default[7].htm

Filesize
305B

MD5
2c4ce699b73ce3278646321d836aca40

SHA1
72ead77fbd91cfadae8914cbb4c023a618bf0bd1

SHA256
e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

SHA512
89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F5C5X26J\default[8].htm

Filesize
304B

MD5
3483bf8f41c9a3b9c4acd2c9be5d8d00

SHA1
fe960cf9b9744217b295ed86f66e80c58c4d6052

SHA256
9b402b64c9cddf2ce4c139df23fd6354b51bb218706076d0b6ed1c128df25535

SHA512
1df7f496dcd70238c3982e595964b552548a7100f3b238a65476cc57fb10e3e1d82c19ffc3f4d61ead29657623665126f3e09561bc0feb39f3aa189f603757db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P1XM92J4\default[2].htm

Filesize
304B

MD5
4d1a10f22e8332513741877c47ac8970

SHA1
f68ecc13b7a71e948c6d137be985138586deb726

SHA256
a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

SHA512
4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TG5I02RO\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp78C2.tmp

Filesize
29KB

MD5
cc479c8708a715fcb7879195838ca8e2

SHA1
436eece3b818e120bce69a222a7b97f91af7271b

SHA256
49fc6d516566e51da4fa93ea424cb6cb461f07b511419195e6e6f70a0bb58398

SHA512
fcc42db64be689e0e49da13819de30fd7dc57cef69fc00efbcc16589c1533de83f3d147f33c2a38714aa17f4985ba996b0f15bdb776817f4b95702375b632585

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
255f9f72cb5be6cb8e3a80df7c191edb

SHA1
3bc6f1771f541b549cd3b48a18d56cb14349f905

SHA256
322f45adf37295b7e24e9fd5756830d1363a5a8dfbe8d5bc356916d424bd4288

SHA512
57728c3f34a6a0953861ef22ca186c61d07ff879b312f6227f40292afa97991292cb8105eeb0278d84f7593062b11677073a3ecc0a486e8a05cb1efe61bbb266

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
ad7b68208194010f54846469fe159490

SHA1
01944ce8c8d54f8fc5bee83e9552514a08d8a561

SHA256
e4ecdb3d56b94227a25c2011ae623532c931f1d83763e1cacd97fd98f3fa31b8

SHA512
c7523268d7134380286fb57ce12a825c0a8d625b2b4f5f2e69a3ae6945564c07810588c405dd09477b46ef16521f5d386b1cc774e63da56d7179d1dbee8a68c7

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/232-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/232-242-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/232-188-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/232-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/232-138-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/232-87-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3068-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-88-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-189-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-243-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads