Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
31-10-2023 08:57
General
-
Target
NEAS.bc55d0e90fa43a787928a2c6e67fe640.exe
-
Size
7.8MB
-
MD5
bc55d0e90fa43a787928a2c6e67fe640
-
SHA1
673cd33651ca154c394e290069409648962dac69
-
SHA256
1c1d0612809c1b98d0acc0258d3a28ba3543081b820863d257d2dc94d25b9ee0
-
SHA512
37f989a7d841f7bc3a8d8b175d0a1c238c44d66ab6c7e37eb0b9f891f4223a1f6dd577806fa955527f45df1a7111fa1b201e5c9019e8ff9e8b0adba04d8f0a79
-
SSDEEP
196608:c6ecrVcUEtl1/VgedP5Qe2MUi/cH6gmmd7I2LRtaJ9R:cWpcZ3ge3Ui/cagmaI2LRMPR
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Program Files (x86)\AtaLib\AtaLib.exe"C:\Program Files (x86)\AtaLib\AtaLib.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "AL1027-3"1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-37BJV.tmp\NEAS.bc55d0e90fa43a787928a2c6e67fe640.tmp"C:\Users\Admin\AppData\Local\Temp\is-37BJV.tmp\NEAS.bc55d0e90fa43a787928a2c6e67fe640.tmp" /SL5="$3014E,7887567,54272,C:\Users\Admin\AppData\Local\Temp\NEAS.bc55d0e90fa43a787928a2c6e67fe640.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query2⤵
-
-
C:\Program Files (x86)\AtaLib\AtaLib.exe"C:\Program Files (x86)\AtaLib\AtaLib.exe" 929446be0341a6d0dfc681ad0032138a2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.bc55d0e90fa43a787928a2c6e67fe640.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.bc55d0e90fa43a787928a2c6e67fe640.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD54de2e6d895dec511cb3ab3b316f2936b
SHA1a865e237ed2d84186b385292a63c72c5bc864ce9
SHA256a286d622700526fb07e02ae1f0d21b16071bfb057dc502588912465758dbc001
SHA512f075c9a069e1c28a6b1f85d9b81af7dcd1deab7472a1323f450ddec3f453cd4dc7557c339b9ff7df4435f162bab3b7450db0811107a3eeb426896971765dc032
-
Filesize
4.6MB
MD54de2e6d895dec511cb3ab3b316f2936b
SHA1a865e237ed2d84186b385292a63c72c5bc864ce9
SHA256a286d622700526fb07e02ae1f0d21b16071bfb057dc502588912465758dbc001
SHA512f075c9a069e1c28a6b1f85d9b81af7dcd1deab7472a1323f450ddec3f453cd4dc7557c339b9ff7df4435f162bab3b7450db0811107a3eeb426896971765dc032
-
Filesize
680KB
MD5f7b197025e844e27abfae965860a962e
SHA1270afb0d64f0c1be08c4b803ab0ac6ce724ba75f
SHA256b180514812407ce53ea0b9a5b2aeddb88e30c65e2d0ec3e74f96f8a7c4562a55
SHA51266a6fdba253adbe9263f1f54954ee1ede18e3fa0bc68b410919c4313bc6ef5076a4d7f9fb8015420270e16991ee72535962eaaffe11bd3825f2e45bf6912b3ba
-
Filesize
680KB
MD5f7b197025e844e27abfae965860a962e
SHA1270afb0d64f0c1be08c4b803ab0ac6ce724ba75f
SHA256b180514812407ce53ea0b9a5b2aeddb88e30c65e2d0ec3e74f96f8a7c4562a55
SHA51266a6fdba253adbe9263f1f54954ee1ede18e3fa0bc68b410919c4313bc6ef5076a4d7f9fb8015420270e16991ee72535962eaaffe11bd3825f2e45bf6912b3ba
-
Filesize
4.6MB
MD54de2e6d895dec511cb3ab3b316f2936b
SHA1a865e237ed2d84186b385292a63c72c5bc864ce9
SHA256a286d622700526fb07e02ae1f0d21b16071bfb057dc502588912465758dbc001
SHA512f075c9a069e1c28a6b1f85d9b81af7dcd1deab7472a1323f450ddec3f453cd4dc7557c339b9ff7df4435f162bab3b7450db0811107a3eeb426896971765dc032
-
Filesize
680KB
MD5f7b197025e844e27abfae965860a962e
SHA1270afb0d64f0c1be08c4b803ab0ac6ce724ba75f
SHA256b180514812407ce53ea0b9a5b2aeddb88e30c65e2d0ec3e74f96f8a7c4562a55
SHA51266a6fdba253adbe9263f1f54954ee1ede18e3fa0bc68b410919c4313bc6ef5076a4d7f9fb8015420270e16991ee72535962eaaffe11bd3825f2e45bf6912b3ba
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
744KB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
8.6MB