f8f7c10e124f7fb88e445fb8c395190e06149dea3d68ebe38572efc21d60c428

Analysis

max time kernel
1385s
max time network
1392s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEFT_Debit.exe
Size

2.6MB
MD5

c9c287de179691fd690a32cd5faad708
SHA1

6e093998c4cd0843b5b3786b14f4a5c92901d9e8
SHA256

f8b8d8a92d0fe133cf1678885042a6c1dab9ccf3b8bacb4bc95c3ad4c2851d28
SHA512

5655317afdde0d1cb5380cfa6f977727274360cf65ee387058962b62f4e5f10df1f3d0f953128d9ad0838bb8b44730e149c45aa645b42ca5b00a83927e42ffa0
SSDEEP

49152:pkWk5cS7a+9XYaQHZehc4mTYJ78V9gyBn4cnfmP/SA8NLfmP/SA8N:1ajJYZ942KQV9hp4AfmP/SA8dfmP/SA8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

NEFT_Debit.exe

pid process

3440 NEFT_Debit.exe
3440 NEFT_Debit.exe
3440 NEFT_Debit.exe

pid	process
3440	NEFT_Debit.exe
3440	NEFT_Debit.exe
3440	NEFT_Debit.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

NEFT_Debit.exe

description	pid	process	target process
PID 3440 wrote to memory of 2000	3440	NEFT_Debit.exe	cmd.exe
PID 3440 wrote to memory of 2000	3440	NEFT_Debit.exe	cmd.exe
PID 3440 wrote to memory of 2000	3440	NEFT_Debit.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\NEFT_Debit.exe
"C:\Users\Admin\AppData\Local\Temp\NEFT_Debit.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads