Overview

overview

8

Static

static

1

NEAS.9d290...c0.exe

windows7-x64

8

NEAS.9d290...c0.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    126s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2023 08:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.9d290612433a6eb3122653d6c444a9c0.exe

  • Size

    7.2MB

  • MD5

    9d290612433a6eb3122653d6c444a9c0

  • SHA1

    8f696ed66972c0a5c0c87a98974d63a1624705f7

  • SHA256

    156af72bf8697e8dda40a5cc4f8168bcc295f320159c380490b3ad355a053e76

  • SHA512

    04655914cf2abd1b54a5872af5fc9ae6d6a70f2540d56346d75fc031a4924837740277e4ed13cd47629b5e6c05a1e3b3d5c3a3070034ced62e38fe1b02d1468e

  • SSDEEP

    98304:lXyrPQb+u6I3YOcIKxb8GPZje8tNJj669cERHEkN+nCFhkdyVknVklBNLCqsG268:l16nGGP88tUdkSCFhCVGBxCR168

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.9d290612433a6eb3122653d6c444a9c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9d290612433a6eb3122653d6c444a9c0.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\SysWOW64\cacls.exe
      cacls C:\WINDOWS\system32\drivers\etc /e /d everyone
      2⤵
        PID:920
      • C:\Program Files\yxdlq\31623dlq.exe
        "C:\Program Files\yxdlq\31623dlq.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1824
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 852
          3⤵
          • Program crash
          PID:4020
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 804
          3⤵
          • Program crash
          PID:3976
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\NEAS.9d290612433a6eb3122653d6c444a9c0.exe"
        2⤵
          PID:3148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1824 -ip 1824
        1⤵
          PID:3088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1824 -ip 1824
          1⤵
            PID:3884

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\yxdlq\31623dlq.exe
            Filesize

            5.4MB

            MD5

            6c7a0f3290c87e3705ce136f82bf88fd

            SHA1

            be80e7f42a38a74769fd5c5056afe209768a0459

            SHA256

            6151b8bd0a81ac933f289c5280e66d4aa78badb25daa55dbe1e9a519f60531c3

            SHA512

            c62df21b494951c1c45ab8c31a9063aa1303a49e77482a5cf98382e79eee07aa6dd5268ab7596fdc642f3080994caac683307060132803eb012095b092c02286

            Download Submit

          • C:\Program Files\yxdlq\31623dlq.exe
            Filesize

            5.4MB

            MD5

            6c7a0f3290c87e3705ce136f82bf88fd

            SHA1

            be80e7f42a38a74769fd5c5056afe209768a0459

            SHA256

            6151b8bd0a81ac933f289c5280e66d4aa78badb25daa55dbe1e9a519f60531c3

            SHA512

            c62df21b494951c1c45ab8c31a9063aa1303a49e77482a5cf98382e79eee07aa6dd5268ab7596fdc642f3080994caac683307060132803eb012095b092c02286

            Download Submit

          • C:\Program Files\yxdlq\31623dlq.exe
            Filesize

            5.4MB

            MD5

            6c7a0f3290c87e3705ce136f82bf88fd

            SHA1

            be80e7f42a38a74769fd5c5056afe209768a0459

            SHA256

            6151b8bd0a81ac933f289c5280e66d4aa78badb25daa55dbe1e9a519f60531c3

            SHA512

            c62df21b494951c1c45ab8c31a9063aa1303a49e77482a5cf98382e79eee07aa6dd5268ab7596fdc642f3080994caac683307060132803eb012095b092c02286

            Download Submit

          • memory/1824-12-0x0000000000400000-0x0000000000A30000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/1824-13-0x0000000000400000-0x0000000000A30000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/1824-15-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1824-19-0x0000000077D32000-0x0000000077D33000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1824-20-0x0000000000400000-0x0000000000A30000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/1824-21-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

            Filesize

            4KB

            Download