156af72bf8697e8dda40a5cc4f8168bcc295f320159c380490b3ad355a053e76

General

Target

NEAS.9d290612433a6eb3122653d6c444a9c0.exe
Size

7.2MB
MD5

9d290612433a6eb3122653d6c444a9c0
SHA1

8f696ed66972c0a5c0c87a98974d63a1624705f7
SHA256

156af72bf8697e8dda40a5cc4f8168bcc295f320159c380490b3ad355a053e76
SHA512

04655914cf2abd1b54a5872af5fc9ae6d6a70f2540d56346d75fc031a4924837740277e4ed13cd47629b5e6c05a1e3b3d5c3a3070034ced62e38fe1b02d1468e
SSDEEP

98304:lXyrPQb+u6I3YOcIKxb8GPZje8tNJj669cERHEkN+nCFhkdyVknVklBNLCqsG268:l16nGGP88tUdkSCFhCVGBxCR168

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	NEAS.9d290612433a6eb3122653d6c444a9c0.exe

Deletes itself 1 IoCs

pid	Process
2636	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2988	22184dlq.exe

Loads dropped DLL 1 IoCs

pid	Process
2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	22184dlq.exe
File opened (read-only)	\??\X:	22184dlq.exe
File opened (read-only)	\??\Y:	22184dlq.exe
File opened (read-only)	\??\N:	22184dlq.exe
File opened (read-only)	\??\R:	22184dlq.exe
File opened (read-only)	\??\T:	22184dlq.exe
File opened (read-only)	\??\G:	22184dlq.exe
File opened (read-only)	\??\M:	22184dlq.exe
File opened (read-only)	\??\V:	22184dlq.exe
File opened (read-only)	\??\Q:	22184dlq.exe
File opened (read-only)	\??\S:	22184dlq.exe
File opened (read-only)	\??\W:	22184dlq.exe
File opened (read-only)	\??\H:	22184dlq.exe
File opened (read-only)	\??\I:	22184dlq.exe
File opened (read-only)	\??\P:	22184dlq.exe
File opened (read-only)	\??\J:	22184dlq.exe
File opened (read-only)	\??\K:	22184dlq.exe
File opened (read-only)	\??\L:	22184dlq.exe
File opened (read-only)	\??\O:	22184dlq.exe
File opened (read-only)	\??\Z:	22184dlq.exe
File opened (read-only)	\??\A:	22184dlq.exe
File opened (read-only)	\??\B:	22184dlq.exe
File opened (read-only)	\??\E:	22184dlq.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\yxdlq\22184dlq.exe	NEAS.9d290612433a6eb3122653d6c444a9c0.exe
File created	C:\Program Files\WinzhConnet\hgx.h	NEAS.9d290612433a6eb3122653d6c444a9c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe
2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2988	22184dlq.exe
Token: SeDebugPrivilege	2988	22184dlq.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe
2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe
2988	22184dlq.exe
2988	22184dlq.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2944	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	28
PID 2720 wrote to memory of 2944	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	28
PID 2720 wrote to memory of 2944	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	28
PID 2720 wrote to memory of 2944	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	28
PID 2720 wrote to memory of 2988	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	30
PID 2720 wrote to memory of 2988	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	30
PID 2720 wrote to memory of 2988	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	30
PID 2720 wrote to memory of 2988	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	30
PID 2720 wrote to memory of 2636	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	32
PID 2720 wrote to memory of 2636	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	32
PID 2720 wrote to memory of 2636	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	32
PID 2720 wrote to memory of 2636	2720	NEAS.9d290612433a6eb3122653d6c444a9c0.exe	32

C:\Users\Admin\AppData\Local\Temp\NEAS.9d290612433a6eb3122653d6c444a9c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9d290612433a6eb3122653d6c444a9c0.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\cacls.exe
  cacls C:\WINDOWS\system32\drivers\etc /e /d everyone
  2⤵
  PID:2944
- C:\Program Files\yxdlq\22184dlq.exe
  "C:\Program Files\yxdlq\22184dlq.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\NEAS.9d290612433a6eb3122653d6c444a9c0.exe"
  2⤵
  - Deletes itself
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\yxdlq\22184dlq.exe

Filesize
5.4MB

MD5
6c7a0f3290c87e3705ce136f82bf88fd

SHA1
be80e7f42a38a74769fd5c5056afe209768a0459

SHA256
6151b8bd0a81ac933f289c5280e66d4aa78badb25daa55dbe1e9a519f60531c3

SHA512
c62df21b494951c1c45ab8c31a9063aa1303a49e77482a5cf98382e79eee07aa6dd5268ab7596fdc642f3080994caac683307060132803eb012095b092c02286

Download Submit
C:\Program Files\yxdlq\22184dlq.exe

Filesize
5.4MB

MD5
6c7a0f3290c87e3705ce136f82bf88fd

SHA1
be80e7f42a38a74769fd5c5056afe209768a0459

SHA256
6151b8bd0a81ac933f289c5280e66d4aa78badb25daa55dbe1e9a519f60531c3

SHA512
c62df21b494951c1c45ab8c31a9063aa1303a49e77482a5cf98382e79eee07aa6dd5268ab7596fdc642f3080994caac683307060132803eb012095b092c02286

Download Submit
\Program Files\yxdlq\22184dlq.exe

Filesize
5.4MB

MD5
6c7a0f3290c87e3705ce136f82bf88fd

SHA1
be80e7f42a38a74769fd5c5056afe209768a0459

SHA256
6151b8bd0a81ac933f289c5280e66d4aa78badb25daa55dbe1e9a519f60531c3

SHA512
c62df21b494951c1c45ab8c31a9063aa1303a49e77482a5cf98382e79eee07aa6dd5268ab7596fdc642f3080994caac683307060132803eb012095b092c02286

Download Submit
memory/2720-9-0x0000000002FD0000-0x0000000003600000-memory.dmp

Filesize
6.2MB

Download
memory/2988-11-0x0000000000400000-0x0000000000A30000-memory.dmp

Filesize
6.2MB

Download
memory/2988-12-0x0000000000400000-0x0000000000A30000-memory.dmp

Filesize
6.2MB

Download
memory/2988-14-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2988-18-0x00000000755E0000-0x00000000756F0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-20-0x0000000000400000-0x0000000000A30000-memory.dmp

Filesize
6.2MB

Download
memory/2988-21-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2988-22-0x00000000755E0000-0x00000000756F0000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing