e93503ec0e84d8825a902e6bc01e110e21943bd5e02cc14baa0d8ec8928621aa

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f80d8fab53ab317d9a20fc3790364700.exe
Size

128KB
MD5

f80d8fab53ab317d9a20fc3790364700
SHA1

82263444e522557425cf458bbe832b23ed5b754b
SHA256

e93503ec0e84d8825a902e6bc01e110e21943bd5e02cc14baa0d8ec8928621aa
SHA512

780b09e7f6f807757b3a0c1f2398c886547e542cae7557811dc9769171b15026bf042d2b4246373e172fe49a90b5565719bc88db70c1379082411e2cc8809fec
SSDEEP

3072:T6mSfjauPZJ3RlSHWvtFrNWtozsf4tQ6Qo1DHfHPEkI+kJb9bdXt1:BuRJqHWotwsf4GWH8kdkVv

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2640	suvkbwn.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\suvkbwn.exe	NEAS.f80d8fab53ab317d9a20fc3790364700.exe
File created	C:\PROGRA~3\Mozilla\wfwcssm.dll	suvkbwn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2640	2720	taskeng.exe	29
PID 2720 wrote to memory of 2640	2720	taskeng.exe	29
PID 2720 wrote to memory of 2640	2720	taskeng.exe	29
PID 2720 wrote to memory of 2640	2720	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.f80d8fab53ab317d9a20fc3790364700.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f80d8fab53ab317d9a20fc3790364700.exe"
1⤵
- Drops file in Program Files directory
PID:2888

C:\Windows\system32\taskeng.exe
taskeng.exe {D328821D-ECB1-4693-829D-417C618E4DAC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\PROGRA~3\Mozilla\suvkbwn.exe
  C:\PROGRA~3\Mozilla\suvkbwn.exe -tlhykym
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\suvkbwn.exe

Filesize
128KB

MD5
c07fc5c55c55c60a2053129503da6ad0

SHA1
a73955a12090afae551c9fca2b5d836717dd3e9a

SHA256
8e1ff18acc3669d224a95159c640197e8c75c0bcdc971722a0ac5c03147bf952

SHA512
e8cc0d3028fb2193503b127e03e288af4a13f03ed2bb5b895b1f3bb4d9a289ba63ecc97b89621332cba3b869f78a0c38a408c4cc58a477627c45be34c5d657d6

Download Submit
C:\PROGRA~3\Mozilla\suvkbwn.exe

Filesize
128KB

MD5
c07fc5c55c55c60a2053129503da6ad0

SHA1
a73955a12090afae551c9fca2b5d836717dd3e9a

SHA256
8e1ff18acc3669d224a95159c640197e8c75c0bcdc971722a0ac5c03147bf952

SHA512
e8cc0d3028fb2193503b127e03e288af4a13f03ed2bb5b895b1f3bb4d9a289ba63ecc97b89621332cba3b869f78a0c38a408c4cc58a477627c45be34c5d657d6

Download Submit
memory/2640-10-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2640-11-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2640-12-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2640-16-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2888-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2888-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2888-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2888-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2888-7-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download