954eed553e4c8aca69c9874074581ec95a5acf59761b43de7b7477bb5261b2be

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
Size

885KB
MD5

119bde2c74fbaa8d7b8f6f668e3194a0
SHA1

c51aeb5791c6c8f217833d07e31e18006160ab3a
SHA256

954eed553e4c8aca69c9874074581ec95a5acf59761b43de7b7477bb5261b2be
SHA512

26ba62d67699336953cc3dc77a654926e08450c82475728160caaf03b16f939b4049c5c5c706a2b7f5259e2cceade3153ebbfc95190069e60ef497a3d4e3dd3e
SSDEEP

6144:5rNH/9fA+WTZgg5I2Bl5K1VxZyRixD4S19/wABrxxJa/YESq:AyuHIZEip4a9/jlDa/ZSq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2104	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Executes dropped EXE 1 IoCs

pid	Process
2104	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Loads dropped DLL 4 IoCs

pid	Process
2176	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2104	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2176	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2104	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2104	2176	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	29
PID 2176 wrote to memory of 2104	2176	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	29
PID 2176 wrote to memory of 2104	2176	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	29
PID 2176 wrote to memory of 2104	2176	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	29
PID 2104 wrote to memory of 2704	2104	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	30
PID 2104 wrote to memory of 2704	2104	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	30
PID 2104 wrote to memory of 2704	2104	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	30
PID 2104 wrote to memory of 2704	2104	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 144
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Filesize
885KB

MD5
139808d143845324b26fad78e589623f

SHA1
ab895f95c18e2256cf6e6067f6eb299877f34954

SHA256
97aa9784e4a198eb1acbe6c5105b474d7e0764550c11083a13c50d717f06776e

SHA512
8594822c38c61a456dafee17266569930415db6ddd72a3efff549f47e1d91c89aaa01b5cd1833abc4d1b8050f102ed3c977548157b1e67e2c528ed0ca30152e8

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Filesize
885KB

MD5
139808d143845324b26fad78e589623f

SHA1
ab895f95c18e2256cf6e6067f6eb299877f34954

SHA256
97aa9784e4a198eb1acbe6c5105b474d7e0764550c11083a13c50d717f06776e

SHA512
8594822c38c61a456dafee17266569930415db6ddd72a3efff549f47e1d91c89aaa01b5cd1833abc4d1b8050f102ed3c977548157b1e67e2c528ed0ca30152e8

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Filesize
885KB

MD5
139808d143845324b26fad78e589623f

SHA1
ab895f95c18e2256cf6e6067f6eb299877f34954

SHA256
97aa9784e4a198eb1acbe6c5105b474d7e0764550c11083a13c50d717f06776e

SHA512
8594822c38c61a456dafee17266569930415db6ddd72a3efff549f47e1d91c89aaa01b5cd1833abc4d1b8050f102ed3c977548157b1e67e2c528ed0ca30152e8

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Filesize
885KB

MD5
139808d143845324b26fad78e589623f

SHA1
ab895f95c18e2256cf6e6067f6eb299877f34954

SHA256
97aa9784e4a198eb1acbe6c5105b474d7e0764550c11083a13c50d717f06776e

SHA512
8594822c38c61a456dafee17266569930415db6ddd72a3efff549f47e1d91c89aaa01b5cd1833abc4d1b8050f102ed3c977548157b1e67e2c528ed0ca30152e8

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Filesize
885KB

MD5
139808d143845324b26fad78e589623f

SHA1
ab895f95c18e2256cf6e6067f6eb299877f34954

SHA256
97aa9784e4a198eb1acbe6c5105b474d7e0764550c11083a13c50d717f06776e

SHA512
8594822c38c61a456dafee17266569930415db6ddd72a3efff549f47e1d91c89aaa01b5cd1833abc4d1b8050f102ed3c977548157b1e67e2c528ed0ca30152e8

Download Submit
memory/2104-10-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2104-11-0x0000000002F00000-0x0000000002FE8000-memory.dmp

Filesize
928KB

Download
memory/2104-15-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2176-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2176-7-0x0000000003000000-0x00000000030E8000-memory.dmp

Filesize
928KB

Download
memory/2176-8-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download