dc92a78991f37fe72df27f5256c67f98b3d934c35267b0ac58ebc4b3c2c3cf17

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.367f260f820e440e1efac7647f472220_JC.exe
Size

324KB
MD5

367f260f820e440e1efac7647f472220
SHA1

074f61dbabf3ecd6cf99e2b278f7e90529c3ce1b
SHA256

dc92a78991f37fe72df27f5256c67f98b3d934c35267b0ac58ebc4b3c2c3cf17
SHA512

11026901438873c25dfea401ae3a03f3e9dd869f82994f8cd664f40d33271107f0935681b1930a838f2294cf6eb313571498637c13c0485b435ca6099ff314dd
SSDEEP

6144:Oej3/wlUOJATJPc827snplX7bP4N9e7FypI8ET+pXfX:Oo34VJATJvpPpyaspPX

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2736	zimfrwc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\zimfrwc.exe	NEAS.367f260f820e440e1efac7647f472220_JC.exe
File created	C:\PROGRA~3\Mozilla\pjqvbbf.dll	zimfrwc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2736	2420	taskeng.exe	29
PID 2420 wrote to memory of 2736	2420	taskeng.exe	29
PID 2420 wrote to memory of 2736	2420	taskeng.exe	29
PID 2420 wrote to memory of 2736	2420	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.367f260f820e440e1efac7647f472220_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.367f260f820e440e1efac7647f472220_JC.exe"
1⤵
- Drops file in Program Files directory
PID:1740

C:\Windows\system32\taskeng.exe
taskeng.exe {166940A0-5921-4F42-B13F-3D002EAA53C6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\PROGRA~3\Mozilla\zimfrwc.exe
  C:\PROGRA~3\Mozilla\zimfrwc.exe -gtjzibe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
324KB

MD5
edb873186d1fc81a83d4cb16fd9ca17b

SHA1
731e0aadf062225ae39534f6d3a23ef4aae2017b

SHA256
c9adb0c18dc4efa27a21df87e1a0371671474d31d29b70ad8bbcb8f90d85db6c

SHA512
37cf8b656d5eb1a9b85d295a50cb1553490025a79c17f36b5db928acfecce79ab0bdf7e15e48d6fb8a6087a7826ee8177c7a4dd078a02195ae2a2c4cb08b9d97

Download Submit
C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
324KB

MD5
edb873186d1fc81a83d4cb16fd9ca17b

SHA1
731e0aadf062225ae39534f6d3a23ef4aae2017b

SHA256
c9adb0c18dc4efa27a21df87e1a0371671474d31d29b70ad8bbcb8f90d85db6c

SHA512
37cf8b656d5eb1a9b85d295a50cb1553490025a79c17f36b5db928acfecce79ab0bdf7e15e48d6fb8a6087a7826ee8177c7a4dd078a02195ae2a2c4cb08b9d97

Download Submit
memory/1740-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-1-0x00000000001B0000-0x000000000020B000-memory.dmp

Filesize
364KB

Download
memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2736-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2736-11-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/2736-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download