Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-11-2023 14:17
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe
-
Size
204KB
-
MD5
b1e7fc37cd8e77c0ed74817a12131d20
-
SHA1
d6d2aabc3ac0a7062949fbeaa411abd6d3a30cf0
-
SHA256
4e4749b1cbcc98c692373e58a94fa95f92d2473198d19e95041c00e76dd84cdf
-
SHA512
1b6872cdd6c0e46905d157f8c74b89718ba23299c5f6e7d497b066124fe98cac9c34a7443b114383c0adadf3c68b0bb82281651936c74419ff08b7af0451db33
-
SSDEEP
3072:Ym1W860tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWnN:jEd4QxL7B9W0c1RCzR/fSmlw
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qouce.exe -
Executes dropped EXE 1 IoCs
pid Process 2780 qouce.exe -
Loads dropped DLL 2 IoCs
pid Process 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /y" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /l" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /k" NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /x" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /p" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /z" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /c" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /g" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /d" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /a" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /n" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /h" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /f" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /s" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /k" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /w" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /e" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /v" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /q" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /b" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /m" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /r" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /o" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /u" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /t" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /i" qouce.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\qouce = "C:\\Users\\Admin\\qouce.exe /j" qouce.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe 2780 qouce.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe 2780 qouce.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2780 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe 28 PID 2136 wrote to memory of 2780 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe 28 PID 2136 wrote to memory of 2780 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe 28 PID 2136 wrote to memory of 2780 2136 NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b1e7fc37cd8e77c0ed74817a12131d20.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\qouce.exe"C:\Users\Admin\qouce.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD50fafb8e454cfd7b2372fa8067fb224cb
SHA10a9bdd310833b7923adffb2ef68d1b2eb6353025
SHA256bedba235efb1449f5a2a59c944dadb2ba4a4018e4460e8c425204cd116fe4817
SHA5122edc5130caab82238824162cc3182405b7a66211ee9cd52c1a9d9bb13df16a79fa8899eb528265fa1d6c9313bed2fcf3e4867a6ed37fcdb86a1302ad15e37f6b
-
Filesize
204KB
MD50fafb8e454cfd7b2372fa8067fb224cb
SHA10a9bdd310833b7923adffb2ef68d1b2eb6353025
SHA256bedba235efb1449f5a2a59c944dadb2ba4a4018e4460e8c425204cd116fe4817
SHA5122edc5130caab82238824162cc3182405b7a66211ee9cd52c1a9d9bb13df16a79fa8899eb528265fa1d6c9313bed2fcf3e4867a6ed37fcdb86a1302ad15e37f6b
-
Filesize
204KB
MD50fafb8e454cfd7b2372fa8067fb224cb
SHA10a9bdd310833b7923adffb2ef68d1b2eb6353025
SHA256bedba235efb1449f5a2a59c944dadb2ba4a4018e4460e8c425204cd116fe4817
SHA5122edc5130caab82238824162cc3182405b7a66211ee9cd52c1a9d9bb13df16a79fa8899eb528265fa1d6c9313bed2fcf3e4867a6ed37fcdb86a1302ad15e37f6b
-
Filesize
204KB
MD50fafb8e454cfd7b2372fa8067fb224cb
SHA10a9bdd310833b7923adffb2ef68d1b2eb6353025
SHA256bedba235efb1449f5a2a59c944dadb2ba4a4018e4460e8c425204cd116fe4817
SHA5122edc5130caab82238824162cc3182405b7a66211ee9cd52c1a9d9bb13df16a79fa8899eb528265fa1d6c9313bed2fcf3e4867a6ed37fcdb86a1302ad15e37f6b
-
Filesize
204KB
MD50fafb8e454cfd7b2372fa8067fb224cb
SHA10a9bdd310833b7923adffb2ef68d1b2eb6353025
SHA256bedba235efb1449f5a2a59c944dadb2ba4a4018e4460e8c425204cd116fe4817
SHA5122edc5130caab82238824162cc3182405b7a66211ee9cd52c1a9d9bb13df16a79fa8899eb528265fa1d6c9313bed2fcf3e4867a6ed37fcdb86a1302ad15e37f6b