Overview

overview

7

Static

static

3

NEAS.fe3bb...JC.exe

windows7-x64

7

NEAS.fe3bb...JC.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2023, 13:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.fe3bb50986a528b9bb04f7e056d8d3c0_JC.exe

  • Size

    1.5MB

  • MD5

    fe3bb50986a528b9bb04f7e056d8d3c0

  • SHA1

    15155ecf77a7b7f3d0eece76fc986769e696d373

  • SHA256

    e53f273b75d83a4101e23605dec2876ea5513f459c3c388c8a58944dc2491002

  • SHA512

    934972e64bd596c901658bb1e72d983f66616305ebb71e02ee2adfd7ac9b59c2f36dde3ac1e13b55fc248cfa87ac884f3ab36d4bf58db01f7b74044735667b4a

  • SSDEEP

    24576:pxWVeyRYWc40RDI1pE25HLaHh3NXYtVvMGNAOfBPCQgtkBfodSq:p8YWl3wWo5KkGNA+CQikBfOSq

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 47 IoCs
  • Drops file in Windows directory 64 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.fe3bb50986a528b9bb04f7e056d8d3c0_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.fe3bb50986a528b9bb04f7e056d8d3c0_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\RCXD3E4.tmp
    Filesize

    1.5MB

    MD5

    eb2aa4f77a60f085749885639ba8a2f2

    SHA1

    22dd77b16bab82d6681eed58a9f55d48b6546ad0

    SHA256

    661ba0f9925839b449d498972a9b92b0052949a275dbac65c20977cf72522ab9

    SHA512

    b3dd3f280daa065155d6411a2618e378a4ebcece637dc888730ce099d3c8a88307b68bcd824e71ffb8e24d2ee475ca0ba541ac78de1a3251c4df460910ce4300

    Download Submit

  • C:\Program Files (x86)\Common Files\System\de-DE\RCXB364.tmp
    Filesize

    1.5MB

    MD5

    75336298cbcb538e0491157831294526

    SHA1

    0dd740a2a497d881fe8b62fa6317d6408f7abfdd

    SHA256

    c87d9056c967f52996eb28d6e8a47ec341b0a7a81f5a325e34978b9d313754c5

    SHA512

    d74f5e035cb247c341cdd214effac948862e010002e272a90ce6335ba0adbb923eebd3a6d2f6c28c2221019c4e41d8b415f0d58504c65710d7ea4fbaa45e1a23

    Download Submit

  • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\Systemresources.exe
    Filesize

    1.5MB

    MD5

    fe3bb50986a528b9bb04f7e056d8d3c0

    SHA1

    15155ecf77a7b7f3d0eece76fc986769e696d373

    SHA256

    e53f273b75d83a4101e23605dec2876ea5513f459c3c388c8a58944dc2491002

    SHA512

    934972e64bd596c901658bb1e72d983f66616305ebb71e02ee2adfd7ac9b59c2f36dde3ac1e13b55fc248cfa87ac884f3ab36d4bf58db01f7b74044735667b4a

    Download Submit