Analysis
-
max time kernel
163s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe
-
Size
416KB
-
MD5
6fcacda1b45b9aad2f417b922f5d4d20
-
SHA1
cee0628be879f8b1247e7d076c6cb5f46fc63f84
-
SHA256
1faeb6943ddaf17bfee5ef1dbc4f3aa1e4c7a335e1ce723d1fe9ac3e630a05f9
-
SHA512
a359cbb38f44da535d4df4c90cedeac3b13694d3f505bbe6655473c2d9df82d5b7490692b3cd74e13e5ba7d59729c85ff5c2ae8e4e50c2f66be7f04d3808c8f0
-
SSDEEP
6144:RqlIyFESWu0SWuUJT/4DO/B52pRr3zmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVK:ty+Jj4DO/B52nZPR
Malware Config
Signatures
-
Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1208 _MpDlpCmd.exe 4292 Zombie.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\it.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp Zombie.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp Zombie.exe File created C:\Program Files\BlockJoin.contact.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\7z.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4992 wrote to memory of 1208 4992 NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe 95 PID 4992 wrote to memory of 1208 4992 NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe 95 PID 4992 wrote to memory of 4292 4992 NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe 97 PID 4992 wrote to memory of 4292 4992 NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe 97 PID 4992 wrote to memory of 4292 4992 NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6fcacda1b45b9aad2f417b922f5d4d20_JC.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\_MpDlpCmd.exe"_MpDlpCmd.exe"2⤵
- Executes dropped EXE
PID:1208
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4292
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5054b8d6e25ffd89c0340a8d85081287d
SHA19a74c3f71eb094f693985ffdd1eb04a1bfae9566
SHA25668ed9035c1ebf3c0dd4617beaa01bdbbab67299dfd5f0fe5961d8c93bf707e66
SHA5127f517c4e97e80728487631c2278422239316ad2c28cfb3b67002869a73b9711197d956741f134f093577744dca23fa276220eb5ab28948b1bca616e02ac6f4a1
-
Filesize
105KB
MD5054b8d6e25ffd89c0340a8d85081287d
SHA19a74c3f71eb094f693985ffdd1eb04a1bfae9566
SHA25668ed9035c1ebf3c0dd4617beaa01bdbbab67299dfd5f0fe5961d8c93bf707e66
SHA5127f517c4e97e80728487631c2278422239316ad2c28cfb3b67002869a73b9711197d956741f134f093577744dca23fa276220eb5ab28948b1bca616e02ac6f4a1
-
Filesize
310KB
MD5c7c81e2467fa619d5b4a03b0fa51519c
SHA139c7ec92e51d72626d4f5d29d80bdf3eb46e8f7c
SHA256e3f1eca768f304512804a54489e8a658e9906e7e0911bb869d03eff140cff5d0
SHA5122438e68ff4cf4bc7d1b8ec9b722e882fa8863cd8690b8c6a03f17d88de1b6eb5697934413ebe4bf1221f1182db841df2ceff4b22a928f577c80968a13b81f8cd
-
Filesize
105KB
MD567ab86fa9c6219322cf3f250b0c21365
SHA178fbd34c8a6eccd30fe00d1bd86cf16e259eb305
SHA2566b96bf239ea3a86178cc4d2568df3f07c531fc81f1a926bf818bd85888789334
SHA512162ac742f39c753d52bb953b231f8add2c03ee36229ac76edaf6bf89de73d3776337114f0f58631aae1c4cef4763523dd612f2de178bd638ca058151cd364bbd
-
Filesize
105KB
MD567ab86fa9c6219322cf3f250b0c21365
SHA178fbd34c8a6eccd30fe00d1bd86cf16e259eb305
SHA2566b96bf239ea3a86178cc4d2568df3f07c531fc81f1a926bf818bd85888789334
SHA512162ac742f39c753d52bb953b231f8add2c03ee36229ac76edaf6bf89de73d3776337114f0f58631aae1c4cef4763523dd612f2de178bd638ca058151cd364bbd