4be8a44b15fbd7987001625fe16bf5b7518588fffe1131feecf3aef944bb2d17

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.a715b649f53eadbd5e43564cb6cfef40.exe
Size

153KB
MD5

a715b649f53eadbd5e43564cb6cfef40
SHA1

cf2bb7b4bbadb00bf0fa4724913e294fe391fa4e
SHA256

4be8a44b15fbd7987001625fe16bf5b7518588fffe1131feecf3aef944bb2d17
SHA512

ce4fd1eb0ccd058cc10997b857e407023d0a674664f4ea3ee64d501061caf7e52b2fa23179e0f3180e22b2f11952b3c5ad9f277e07735f0a464c50e8facf9e92
SSDEEP

3072:ZHrEI6rvvMV0nE17B+TnFnW5/bi13lNvuCLeEPbUXHrJ61e8:5wHMV0nE1l+LtuTS/aSUXLJu

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2628	wwljcul.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\wwljcul.exe	NEAS.a715b649f53eadbd5e43564cb6cfef40.exe
File created	C:\PROGRA~3\Mozilla\sdwojsn.dll	wwljcul.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2628	1852	taskeng.exe	28
PID 1852 wrote to memory of 2628	1852	taskeng.exe	28
PID 1852 wrote to memory of 2628	1852	taskeng.exe	28
PID 1852 wrote to memory of 2628	1852	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.a715b649f53eadbd5e43564cb6cfef40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a715b649f53eadbd5e43564cb6cfef40.exe"
1⤵
- Drops file in Program Files directory
PID:2212

C:\Windows\system32\taskeng.exe
taskeng.exe {292B59B0-2486-4D25-AC26-06DDAA045033} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\PROGRA~3\Mozilla\wwljcul.exe
  C:\PROGRA~3\Mozilla\wwljcul.exe -anxczaj
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\wwljcul.exe

Filesize
153KB

MD5
271e9b5ff308389a9f9ebb6b4f2aa51b

SHA1
78fe25693240492063374eb78eaa043b12879de0

SHA256
1f6a98ea2765ee027304e1b40b29c8dbe55e548b65899f64194da6f961eb872c

SHA512
2a134f7d9eb3b612f9a420314ab29236b882e9fdcf74e79f0c813e17bfbc14ced64527a91a95ca1031b8147b04871ebde4280fb25596d074ddabb2f88af22feb

Download Submit
C:\PROGRA~3\Mozilla\wwljcul.exe

Filesize
153KB

MD5
271e9b5ff308389a9f9ebb6b4f2aa51b

SHA1
78fe25693240492063374eb78eaa043b12879de0

SHA256
1f6a98ea2765ee027304e1b40b29c8dbe55e548b65899f64194da6f961eb872c

SHA512
2a134f7d9eb3b612f9a420314ab29236b882e9fdcf74e79f0c813e17bfbc14ced64527a91a95ca1031b8147b04871ebde4280fb25596d074ddabb2f88af22feb

Download Submit
memory/2212-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2212-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2212-2-0x00000000002B0000-0x000000000030B000-memory.dmp

Filesize
364KB

Download
memory/2212-8-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2628-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download