88aa00d52169d51013310e2fa18eda1cc38a526b82f0e58b51a6d172b951d508

Analysis

max time kernel
168s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
Size

1.9MB
MD5

91de6dd01e677e03874bfca807804f50
SHA1

3edd1b79704be9e86b60173089886e2fdf51fa48
SHA256

88aa00d52169d51013310e2fa18eda1cc38a526b82f0e58b51a6d172b951d508
SHA512

08dcd513f56b1a1fced22c11f764e0d0bbafbc217901c4c6f11a3484d079f2e10eb1f669c0ab36b8c0235b42822d600d8406cff502f6eb6896cb2a52bb215914
SSDEEP

24576:C6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqDs:CCqm2Jpr0nNM7Dus7NxV

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2292-0-0x0000000000400000-0x00000000005D8000-memory.dmp	upx
behavioral2/files/0x0002000000022463-5.dat	upx
behavioral2/memory/2292-77-0x0000000000400000-0x00000000005D8000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mng.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
File created	C:\Program Files\CloseSuspend.wdp.exe	NEAS.91de6dd01e677e03874bfca807804f50_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.91de6dd01e677e03874bfca807804f50_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.91de6dd01e677e03874bfca807804f50_JC.exe"
1⤵
- Drops file in Program Files directory
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.9MB

MD5
3338a764b0502857c6f59a3b9995d1ac

SHA1
720b2be8fdcd448ef1b11b8aa2d45cd597d19d71

SHA256
5c4ef97bb4bf56633227501bebd6e6a70bacdfdb4df09754f3212069ff7a2ab4

SHA512
edca2a4c03abe106f2704e677c2a3f7ab5fc248c5f1754a84d368f8df54e505d59a0c79d9a1170c6ecc6ee9d4296487c5308fb158656d055cbd193d196ce5c39

Download Submit
memory/2292-0-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2292-77-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads