65722379adb9a6497e28c5aaed8af37aacc04c5b44c14b538a89091b59ce5ce2

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.644d40a303585dbab155029e69ca93f0.exe
Size

1.3MB
MD5

644d40a303585dbab155029e69ca93f0
SHA1

36c212c927e22937e8f7d0f0c17d9760d19bccc0
SHA256

65722379adb9a6497e28c5aaed8af37aacc04c5b44c14b538a89091b59ce5ce2
SHA512

f9761d8d750aa5cb5edf54eeda1f59143a18907d30916d6a39751a95c59b172dc7cc208d869f9b15b4949a341f36295a061d9c244b72b9235bc747790ebf6d66
SSDEEP

24576:6wEh5JwhOP7OU8titDdB0DPXytaN+lE2wAdAyq7meznmSFeXGMt/xwCqaLw0IUo:6XSho88RdeitaAKbabXGMtpRNLw0IUo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2180	sxe8474.tmp

Loads dropped DLL 2 IoCs

pid	Process
2864	NEAS.644d40a303585dbab155029e69ca93f0.exe
2864	NEAS.644d40a303585dbab155029e69ca93f0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2180	2864	NEAS.644d40a303585dbab155029e69ca93f0.exe	85
PID 2864 wrote to memory of 2180	2864	NEAS.644d40a303585dbab155029e69ca93f0.exe	85
PID 2864 wrote to memory of 2180	2864	NEAS.644d40a303585dbab155029e69ca93f0.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.644d40a303585dbab155029e69ca93f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.644d40a303585dbab155029e69ca93f0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp
  "C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp"
  2⤵
  - Executes dropped EXE
  PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sxe8414.tmp

Filesize
15KB

MD5
bd815b61f9948f93aface4033fbb4423

SHA1
b5391484009b39053fc8b1bba63d444969bafcfa

SHA256
b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76

SHA512
a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxe8414.tmp

Filesize
15KB

MD5
bd815b61f9948f93aface4033fbb4423

SHA1
b5391484009b39053fc8b1bba63d444969bafcfa

SHA256
b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76

SHA512
a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp

Filesize
3.8MB

MD5
243f215d03ddf12e6821ac05baa421e7

SHA1
39b29859050e7929497631c3753e026ded40b38b

SHA256
4e061597af4079474ae1e12da8f330d3df5fdce436c24e3acdffe6bbeacb034f

SHA512
571af157c208150b37b83ba748898157c0f1d8f7997e623e7f4efd076a7ba0dc2c5c4347b396904469b062f0849ef9411b8bc894dfe495c868622a1c80e7ba09

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp

Filesize
3.8MB

MD5
243f215d03ddf12e6821ac05baa421e7

SHA1
39b29859050e7929497631c3753e026ded40b38b

SHA256
4e061597af4079474ae1e12da8f330d3df5fdce436c24e3acdffe6bbeacb034f

SHA512
571af157c208150b37b83ba748898157c0f1d8f7997e623e7f4efd076a7ba0dc2c5c4347b396904469b062f0849ef9411b8bc894dfe495c868622a1c80e7ba09

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads