Analysis
-
max time kernel
86s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e118e89dd18f141ff1794c09333acf80.exe
Resource
win7-20231023-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.e118e89dd18f141ff1794c09333acf80.exe
Resource
win10v2004-20231020-en
2 signatures
150 seconds
General
-
Target
NEAS.e118e89dd18f141ff1794c09333acf80.exe
-
Size
1.2MB
-
MD5
e118e89dd18f141ff1794c09333acf80
-
SHA1
2128bd7eabe491a78ea7e974ff4c7dc37f0a5ed8
-
SHA256
02ad83eafc1ef58f0b54baf71c03c6f180a37a30ba1957fd2173d11066198a96
-
SHA512
279c5e362d18e88e4df487cae5e5f289ca8be2f51daa154215f0c21a16c4c08fd0d939c128267e3a20ab2db92efa8276196f600d45f9f437518dc8e72b09e877
-
SSDEEP
12288:wfGXWfmeok3QGzUwjjydIxJMrxylL0jnX0y3T5IPDmBsT:KGXWrI4604X0Cf
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe NEAS.e118e89dd18f141ff1794c09333acf80.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3572 NEAS.e118e89dd18f141ff1794c09333acf80.exe