Analysis

  • max time kernel
    168s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 13:50

General

  • Target

    NEAS.0010e671fe10ac9cb12042db8d402550.exe

  • Size

    29KB

  • MD5

    0010e671fe10ac9cb12042db8d402550

  • SHA1

    bd976f109273ed93554ce8ada351f7b17e7dbe90

  • SHA256

    bb78e29beb07d318c0e66231a856a74b722f7f763b4e45e9203a82e07414f721

  • SHA512

    2ec3f073acebb2e54d72d60111708498bdead4cfe9bc76907f3b2e4415e9df7be7f00dc8b95806eb0c916a57ad4c2227cdb0af3e407e7b6738699081383f5a3a

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/O3:AEwVs+0jNDY1qi/qG3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.0010e671fe10ac9cb12042db8d402550.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.0010e671fe10ac9cb12042db8d402550.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3692
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1GRKGEIB\default[1].htm

    Filesize

    304B

    MD5

    3483bf8f41c9a3b9c4acd2c9be5d8d00

    SHA1

    fe960cf9b9744217b295ed86f66e80c58c4d6052

    SHA256

    9b402b64c9cddf2ce4c139df23fd6354b51bb218706076d0b6ed1c128df25535

    SHA512

    1df7f496dcd70238c3982e595964b552548a7100f3b238a65476cc57fb10e3e1d82c19ffc3f4d61ead29657623665126f3e09561bc0feb39f3aa189f603757db

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1GRKGEIB\default[3].htm

    Filesize

    304B

    MD5

    605de1f61d0446f81e63c25750e99301

    SHA1

    0eaf9121f9dc1338807a511f92ea0b30dc2982a5

    SHA256

    049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

    SHA512

    a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1GRKGEIB\default[4].htm

    Filesize

    303B

    MD5

    6a62ed00d5950a7aa3df6d446d0beb92

    SHA1

    608da2a7b63e92b731a7beb2d990405d7a6e9611

    SHA256

    7aaaf31ea9c2999c775008a4b769336c91d87dc8f6dc0a1015bb45c61bc39fdb

    SHA512

    10a77d30bd2a5a930233e79830ac6e0a695bcfacb4e33fe9a67a7dc4b4c0ffaf3ca6ce458bf2a6714b9c590997ff816f207bee87536516a2c8e711c3c161773d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1GRKGEIB\default[8].htm

    Filesize

    302B

    MD5

    3c46188276167b3b8cb0c2e9043a8b8a

    SHA1

    fdbf02d5c5673ee2f52374d34d9e7406219c9787

    SHA256

    6681ad016b8aafa6f1724ac781e0e7c8c8b5eb39ca7c3afed8d2ff4787f178ea

    SHA512

    3be340b703cf982ede8650de50fbbdc397573dfcabd624c998a4136625a35205dae0b787f10a65987d32fdd6d2c61e04e5e50ddb82da5e40d54e6b7fc75e36c9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K1QHLR0H\default[1].htm

    Filesize

    302B

    MD5

    485828cfdc2c1efc0c51ff9b74dd34f8

    SHA1

    6f685134b031e9b2fff0eb8c7212c99bfba3719f

    SHA256

    615a15f6247f8f979b3a066801c98489018b1d137fd5d9b7bce73824acc70f06

    SHA512

    69736b9700c2f47feab282d8bf8bd6f02c9f62ecb9c02466b6cf76b1cd4b1becc70803123e73427c871c2aeb2eb64540edf95a342f78d9211ac0571e8fd1f426

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K1QHLR0H\default[4].htm

    Filesize

    305B

    MD5

    18c1b0bbcc593e57a21ec5dac93ac194

    SHA1

    e9e5a1c08a29384d4810d0631eb8fd255895b80e

    SHA256

    f68a79cee1ff19e11499a1d120e68f42344eaa9a9defe72b01e8ffbc93cfdc79

    SHA512

    7853e002a943f2232f7041d789c7ba197502b2d0e250cd960ccd91f11d81666375e6aac67ea08cc13802decfa003f259b987b630882c0d6ee64882d511515377

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UDS0USIU\default[2].htm

    Filesize

    304B

    MD5

    4d1a10f22e8332513741877c47ac8970

    SHA1

    f68ecc13b7a71e948c6d137be985138586deb726

    SHA256

    a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

    SHA512

    4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UDS0USIU\default[3].htm

    Filesize

    303B

    MD5

    0a53779b07f9c9c56ef169499851915e

    SHA1

    281bf81610dae812be159f95a0858f88f9b96637

    SHA256

    b946117d346ecf850135aae1ac65b368f4effd806bf5180ecd3c585f1324dbd1

    SHA512

    5a5016dcdeef68be7115eafee0a6844e3cc868fa04f353980d924fca7394962d919d8dece40b15b7ddcc867f956fc8c0e522b68688ca409f1671c39e42973dc6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UDS0USIU\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5A2S7N8\default[3].htm

    Filesize

    305B

    MD5

    2c4ce699b73ce3278646321d836aca40

    SHA1

    72ead77fbd91cfadae8914cbb4c023a618bf0bd1

    SHA256

    e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

    SHA512

    89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5A2S7N8\default[9].htm

    Filesize

    312B

    MD5

    c15952329e9cd008b41f979b6c76b9a2

    SHA1

    53c58cc742b5a0273df8d01ba2779a979c1ff967

    SHA256

    5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

    SHA512

    6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

  • C:\Users\Admin\AppData\Local\Temp\lsh2p.log

    Filesize

    256B

    MD5

    88d9b92e26015240c50a42b2c1a7828e

    SHA1

    77998489307e3eab4960b7fad1c81d38d6b7b60a

    SHA256

    4d0d54c45ccdf4282aa7c2cfd43ba1b9d7a37da08beeed9db9f442380eecd86a

    SHA512

    cf1b3cd5d161ca09f7ceafb53bbb21415639d63f94d72e64e644b4d82b8e4e593457d2ae66a6164910c9c0eb1087e89c7e6b29520560f34d043770fc950db8a6

  • C:\Users\Admin\AppData\Local\Temp\tmpAF29.tmp

    Filesize

    29KB

    MD5

    0010e671fe10ac9cb12042db8d402550

    SHA1

    bd976f109273ed93554ce8ada351f7b17e7dbe90

    SHA256

    bb78e29beb07d318c0e66231a856a74b722f7f763b4e45e9203a82e07414f721

    SHA512

    2ec3f073acebb2e54d72d60111708498bdead4cfe9bc76907f3b2e4415e9df7be7f00dc8b95806eb0c916a57ad4c2227cdb0af3e407e7b6738699081383f5a3a

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    897d34960dae9339aa2df538f8983ffa

    SHA1

    985de8d1df1a82c855c396d75d61d57f2eb753a4

    SHA256

    a4cba4070811107c8e1bcbca0b9510f71dfb9d227d0b481bca363d3faecacf5e

    SHA512

    11ef050c858950891489f3c6b84cd7323e06bdd1545b94291caf3b2729bd9415be3e954f5cd96e9bfdb2db4467c9b7b2c0b16b461e1104822de8ca8c423fac5b

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    15ccedd70b68b06fee8176edb5d2aed7

    SHA1

    5d5ff5653c762677e87f2689384711519f77fb11

    SHA256

    20d62a9a7cfa5e5484e9a61e968288c2d9c002acb270b93f5492e617f35e4147

    SHA512

    5a323b10c97f641c859ba28a45f9f99b0122f3e1727f54329810aa8723b15218bd321581b3b0f39f62d3cd0026982f2c0b433071a74300de67db8d8d19c273af

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/3024-14-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-291-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-54-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-468-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-193-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-241-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-429-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-105-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-152-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-386-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3024-334-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3692-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-143-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-377-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-323-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-286-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-419-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-93-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-235-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-460-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-190-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3692-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB