Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2023 19:31

General

  • Target

    NEAS.d5b594a1b5cd1dde4972108f285d0c10_JC.exe

  • Size

    96KB

  • MD5

    d5b594a1b5cd1dde4972108f285d0c10

  • SHA1

    c4bef3490ae15c8fd57198d2f27a8c635f26234b

  • SHA256

    bc2f6b4a6f9fe0cf65862b155f1f9c560fb523509b3df3993a4fc28dfbb0aa83

  • SHA512

    f3f6b820c18ae03f2c0dc4be0f760832ca5aad998054dacf336fe1708bd968a6d6d0174e04f67aa5f13a3beedcac21fd3987d62dd954e52190085d12cc466f45

  • SSDEEP

    3072:vAowugFgjTiUkEwtkXoUTiUkEwtHaeEpIaCtwUaSvcmGCCCCCCC+EaEAEtHjCCCg:oabjGUkfBUGUkfC

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.d5b594a1b5cd1dde4972108f285d0c10_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.d5b594a1b5cd1dde4972108f285d0c10_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    96KB

    MD5

    1472468b4b3397d0b337868cd42163a6

    SHA1

    692f142d94f5f48fefb321fd81226f5460c78ea3

    SHA256

    c6222ee56b6c25f491aa00d2a7d856cc911cb5bd7534c6b733e2dc547405db0e

    SHA512

    f160b1a3f96383d548b959987d20dbab6e5fe4108a491ef3458ab42fd3e9c7966f583330dd4c7579359eb7a9e67e8dba83c48588706fa4009b14f0eeaa33a481

  • C:\Windows\microsofthelp.exe

    Filesize

    96KB

    MD5

    1472468b4b3397d0b337868cd42163a6

    SHA1

    692f142d94f5f48fefb321fd81226f5460c78ea3

    SHA256

    c6222ee56b6c25f491aa00d2a7d856cc911cb5bd7534c6b733e2dc547405db0e

    SHA512

    f160b1a3f96383d548b959987d20dbab6e5fe4108a491ef3458ab42fd3e9c7966f583330dd4c7579359eb7a9e67e8dba83c48588706fa4009b14f0eeaa33a481

  • memory/1568-6-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2692-0-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2692-5-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB