7559f8fee29cec83f48d4956d6f2c623c4542113ba7339921f0d889d075846df

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.39bff88597a09e4d5f1b081a412c5150.exe
Size

209KB
MD5

39bff88597a09e4d5f1b081a412c5150
SHA1

c7eacce4dbd7ed7f2a1274fd98af6877d827bc55
SHA256

7559f8fee29cec83f48d4956d6f2c623c4542113ba7339921f0d889d075846df
SHA512

d4247af7db6908ac4b6d0163f5977c0fd9957695954c06edd86f59381ec9a1ec78302cec6ac8ca2217d50deced857fcaf12d511514320900f8c553b95c2bbbee
SSDEEP

3072:ZQcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:ZQh9tVRm2kh34hdeCkcG7DEALLlnN

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1288	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1364	NEAS.39bff88597a09e4d5f1b081a412c5150.exe
1364	NEAS.39bff88597a09e4d5f1b081a412c5150.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1364-1-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1364-16-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1288-17-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1288-39-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\9239f6d0 = "C:\\Windows\\apppatch\\svchost.exe"	NEAS.39bff88597a09e4d5f1b081a412c5150.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\9239f6d0 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	NEAS.39bff88597a09e4d5f1b081a412c5150.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	NEAS.39bff88597a09e4d5f1b081a412c5150.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe
1288	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1364	NEAS.39bff88597a09e4d5f1b081a412c5150.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1288	1364	NEAS.39bff88597a09e4d5f1b081a412c5150.exe	28
PID 1364 wrote to memory of 1288	1364	NEAS.39bff88597a09e4d5f1b081a412c5150.exe	28
PID 1364 wrote to memory of 1288	1364	NEAS.39bff88597a09e4d5f1b081a412c5150.exe	28
PID 1364 wrote to memory of 1288	1364	NEAS.39bff88597a09e4d5f1b081a412c5150.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.39bff88597a09e4d5f1b081a412c5150.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.39bff88597a09e4d5f1b081a412c5150.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
4d6046911643a7c248b1a366943cbf09

SHA1
c8de27e2b95c6f3d1343a0645f51c3c1f498d7c1

SHA256
8a88f33df176afa5d749da5bd396a395935313643f588eefa03df90a9d683cd8

SHA512
f574cef03b78c081e6a3cf9c8c606552ec5ca4a9e41a5724526c163e15e74396df71e648a4a45f6b42184b1871ff57d5bd1578f47c564d38aee6582f41fe6992

Download Submit
C:\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
4d6046911643a7c248b1a366943cbf09

SHA1
c8de27e2b95c6f3d1343a0645f51c3c1f498d7c1

SHA256
8a88f33df176afa5d749da5bd396a395935313643f588eefa03df90a9d683cd8

SHA512
f574cef03b78c081e6a3cf9c8c606552ec5ca4a9e41a5724526c163e15e74396df71e648a4a45f6b42184b1871ff57d5bd1578f47c564d38aee6582f41fe6992

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
4d6046911643a7c248b1a366943cbf09

SHA1
c8de27e2b95c6f3d1343a0645f51c3c1f498d7c1

SHA256
8a88f33df176afa5d749da5bd396a395935313643f588eefa03df90a9d683cd8

SHA512
f574cef03b78c081e6a3cf9c8c606552ec5ca4a9e41a5724526c163e15e74396df71e648a4a45f6b42184b1871ff57d5bd1578f47c564d38aee6582f41fe6992

Download Submit
\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
4d6046911643a7c248b1a366943cbf09

SHA1
c8de27e2b95c6f3d1343a0645f51c3c1f498d7c1

SHA256
8a88f33df176afa5d749da5bd396a395935313643f588eefa03df90a9d683cd8

SHA512
f574cef03b78c081e6a3cf9c8c606552ec5ca4a9e41a5724526c163e15e74396df71e648a4a45f6b42184b1871ff57d5bd1578f47c564d38aee6582f41fe6992

Download Submit
\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
4d6046911643a7c248b1a366943cbf09

SHA1
c8de27e2b95c6f3d1343a0645f51c3c1f498d7c1

SHA256
8a88f33df176afa5d749da5bd396a395935313643f588eefa03df90a9d683cd8

SHA512
f574cef03b78c081e6a3cf9c8c606552ec5ca4a9e41a5724526c163e15e74396df71e648a4a45f6b42184b1871ff57d5bd1578f47c564d38aee6582f41fe6992

Download Submit
memory/1288-32-0x0000000002200000-0x0000000002299000-memory.dmp

Filesize
612KB

Download
memory/1288-28-0x0000000000470000-0x00000000004FA000-memory.dmp

Filesize
552KB

Download
memory/1288-39-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1288-17-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1288-18-0x0000000000470000-0x00000000004FA000-memory.dmp

Filesize
552KB

Download
memory/1288-20-0x0000000000470000-0x00000000004FA000-memory.dmp

Filesize
552KB

Download
memory/1288-22-0x0000000000470000-0x00000000004FA000-memory.dmp

Filesize
552KB

Download
memory/1288-24-0x0000000000470000-0x00000000004FA000-memory.dmp

Filesize
552KB

Download
memory/1288-26-0x0000000000470000-0x00000000004FA000-memory.dmp

Filesize
552KB

Download
memory/1288-38-0x0000000002200000-0x0000000002299000-memory.dmp

Filesize
612KB

Download
memory/1288-34-0x0000000002200000-0x0000000002299000-memory.dmp

Filesize
612KB

Download
memory/1288-30-0x0000000002200000-0x0000000002299000-memory.dmp

Filesize
612KB

Download
memory/1288-33-0x0000000002200000-0x0000000002299000-memory.dmp

Filesize
612KB

Download
memory/1364-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1364-0-0x0000000001C10000-0x0000000001C68000-memory.dmp

Filesize
352KB

Download
memory/1364-15-0x0000000001C10000-0x0000000001C68000-memory.dmp

Filesize
352KB

Download
memory/1364-16-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download