Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
01/11/2023, 13:56
General
-
Target
NEAS.3204621374b8b14d6b704363e5bcf3b0.exe
-
Size
355KB
-
MD5
3204621374b8b14d6b704363e5bcf3b0
-
SHA1
d01ad773d481d2920194967402fbe16b01e3f8b4
-
SHA256
8f23846542c1e11e881a168e2961760e99a43d712451f48497ff195d6c595f26
-
SHA512
2511f2ee43f97d988b6eab08ec7c7e8a976b1b4bc0e4eb219c84686c1de613ebcb387b2df21cc39a85fa7d6393fa6a964ee96ff195f2f600e704b8bf93ba655e
-
SSDEEP
6144:x3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:2mWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3204621374b8b14d6b704363e5bcf3b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3204621374b8b14d6b704363e5bcf3b0.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
12KB
MD51639705c0468ff5b89d563cc785c9374
SHA1f6807f616bab661123da67196ca7d5015df9ea82
SHA2564788bc2f12f5ef35a1e86ba33d4ecd9efcc89446502465d7e8320a36c6a0e25c
SHA512d50f65b6100586ddda7d62a8d21d013e0c5d4c52a2fc5d53867ba086571116dac992eefd2fb55873196f3516bac91c9cff8da5f4b8f91e5f9c13240e5622d768
-
Filesize
1KB
MD5967f449857045a8ac37142554829e512
SHA12461bc72613fcef02773a5ac243752d07e0cb60b
SHA256a7e3b0dbbf501a01472719391517e24e47f7f9352d3e38700d51ff2cd0b2ffcd
SHA5120923edf1bd3a155a5d1df046a7eb6a3bf029290bf51199727ae555e387943d7da2888618d997d8c2fa4b96a6379d3a772e404419dd7e099f564d43aff0d27cfa
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
2KB
MD5aacebb2341171bbd092fa8fcdfb844ca
SHA154e00d967b98ce4548c96698201bb0c089988409
SHA256835ebf16540df12bff1d88c6b4fd1b430af0dc5734668223c1c35605e0233821
SHA512246dd5fe9c6091a77685f669f24689b2b5116943b201942bf85efa85bac7084d4c5b066195cbfd85131c16aab62981161e4384a5629ddac8b3d16a69e2a57db1
-
Filesize
2KB
MD5a8fdd0012e6998420474a0c0669327c4
SHA1aa0b687e766c259a247c16677f4c631ce542fc6e
SHA25685a0119ffb919c7b1157dabbc8e40897f97ce6544f89931e503564966057d5d6
SHA512bd834b7119f51ef0c741d2c0696e449e13a003140ad631f5e272130cac2d30f8cb25a5e76cc415ddf6208ee920efed6c7c33519b8f1bd02dd4ae8d3f39e926f5
-
Filesize
2KB
MD5450d22892e11a6198bbc3c64131156ed
SHA1d1a29ff5ddbbea9f2f2b1421c11c3802c97fd686
SHA2561cd7871271f9cb9de152fbf7ead1731a432fc49864f8a7bfdc8d79510f1bc62f
SHA512ee4b602f0d7a97a2e0e85f2d9ba5b9585fbad1d661d5e57fc1c07ce813251847da84c035a4374b51a660bfd62986ae276933919bfeccd44c504477137b1c2771
-
Filesize
41KB
MD52238c05ad4e271d7c9faedd864b0e00e
SHA17e13f3614855fa4f2637cb5d00d56ac357974c1b
SHA2567567ca8d9326bd866f1fe695062406dc5620f0b7dbd2afe8ac44c8c404222884
SHA512c46a96d9b350e650867d8b57b09e4560e5c46ef6dfb1622e20bc5e7147a741f91e7c250c3a84248eb4b32b9fc37a10b3cd9c204127976196f46f6ccc36f5ed16
-
Filesize
1KB
MD57e28a2290977d8d8af093e33d2df3586
SHA1b8c66b415ea94a4c19972d35501cbf4e057118cb
SHA256f11720f2238a76109bff6fe62293ff09979c9ec2f227a8e8fa0e399f52ef689e
SHA51216d6f04db1a77a20d558fc6b0e127d6bc22876d688a65aa5f90f79882073fbb7714f6db8e6056fee7929ca32bc4fefd5050a2b3eae8189af8f3aa7f1e1f248f6
-
Filesize
481B
MD53d5522e9d3a99582df55a3cc34239f39
SHA1fa73d4773af16f5567bdedcb6644e1db9f82b83c
SHA256d9f2423c678eb9f2c24652fa8c8a750bd4c32b471ef0d1542b987b490853e9b5
SHA512fca75634b351183d59859b5b1a45d847d083b26e55da566e32720a4b3723642a50bae3a79aa15069bfc3cc2399f0de3de63c7b2afc2f13b70d14d7b8ab9d7dc8
-
Filesize
1KB
MD51461e528ff5198e0b0829099e04329b7
SHA1b364e0e8a06b5d7c0a210f52371dcfab426cca69
SHA256d115367c80b3f902a902dfa95ee4b89881694c6dfe8258c4d800b7b4f0338cf2
SHA512ffcfaf0ee03c3ebae14742ef289427c7f9de3e6ae54fd2e83d746796917c8ece772e5953eeecbedc2b250b6b280dfe3227edd18e259fc8556521152e127f2a79
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD536499db2108c7ad48e13fff52e985e2a
SHA11f1e301afe10bcfb06c3d47e2c9fd89ff321b2d6
SHA25641ff6a06ec45004aade4c6bb74b152c610611519689b84471f3982c82e8fe7f9
SHA512416eaf6ef462e11e95540e7817df28bf3d8662abc2b24c643cafee5f8c18e3d8c15fd4088d326441c513a3ab4126d6777974b57d46e3a78d00949554c1a569e6
-
Filesize
22KB
MD5692e132e9dbc125f535a299bd3ad0235
SHA111c14ae5dad3f5866c61dfeaae17b0a945c476b2
SHA25641c50abf8e8cecd3913000d66baede46e89af31af94565cb225d8e8903550b28
SHA512afc2be81652ca95f0624d11d350e12b7f35f3b356bfce1f3300f9c589fff339b98cef4988543529eb90e9934d3df21d6fff67a10c64a03e320a317f7d9d6cc3d
-
Filesize
2KB
MD5142ac69cebf891715009865778992dab
SHA149384ae86ec2527a19ee366a2a0467e06154f63c
SHA25642fc72e5f67ad76899fadb8c018a60fa1ec61816812c8c8ac6791c380cfa7fc6
SHA51289fb8588bb30df1f8b6f39aaf0d26fa14601c79808f9a4bd3f7a4f9e0139fa6fb58354f2c6cb381231bfa4ba7ce218e13138fb093c09ea76754a4a4cf811adac
-
Filesize
355KB
MD51385b41ee42f39decb307d7c0726b8ed
SHA122023b75642bbdec60c98a90666aece2eb7711a5
SHA256b731edd9805d16c90daae1b3786fd1b546889a8736fc8d170e9c507ac159e120
SHA512ff91ab45c3f41a2327331ad82cbf8aedb7137a5b6b203738385ee786938f3270a2d304fdfc6c0483e4e3088c807170ab6a786c7867446b3eb4e88504f264c1eb
-
Filesize
355KB
MD51385b41ee42f39decb307d7c0726b8ed
SHA122023b75642bbdec60c98a90666aece2eb7711a5
SHA256b731edd9805d16c90daae1b3786fd1b546889a8736fc8d170e9c507ac159e120
SHA512ff91ab45c3f41a2327331ad82cbf8aedb7137a5b6b203738385ee786938f3270a2d304fdfc6c0483e4e3088c807170ab6a786c7867446b3eb4e88504f264c1eb
-
Filesize
355KB
MD51385b41ee42f39decb307d7c0726b8ed
SHA122023b75642bbdec60c98a90666aece2eb7711a5
SHA256b731edd9805d16c90daae1b3786fd1b546889a8736fc8d170e9c507ac159e120
SHA512ff91ab45c3f41a2327331ad82cbf8aedb7137a5b6b203738385ee786938f3270a2d304fdfc6c0483e4e3088c807170ab6a786c7867446b3eb4e88504f264c1eb
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB