Overview

overview

8

Static

static

3

NEAS.3a8cf...a0.exe

windows7-x64

8

NEAS.3a8cf...a0.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.3a8cf5042c6283584696578331f8aca0.exe

  • Size

    328KB

  • Sample

    231102-t7qs3sgb2x

  • MD5

    3a8cf5042c6283584696578331f8aca0

  • SHA1

    ec2a833e84421dfc2159a4269bdbc2e6ba7398c8

  • SHA256

    743aecdb6460a4cb67017707c2c5280e4d9245056de9abafc7b99547729411b1

  • SHA512

    81d45252a91c8aa9a25b7d2f33533b280876ec127cf6f68d2c1a9c7438d5746154536f030b0145dad35ed78c15e802d51a2ea87dc8808796399c3d7ba9876f2f

  • SSDEEP

    6144:iyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:iCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score
8/10
adwarediscoveryexploitpersistencestealer

Malware Config

Targets

    • Target

      NEAS.3a8cf5042c6283584696578331f8aca0.exe

    • Size

      328KB

    • MD5

      3a8cf5042c6283584696578331f8aca0

    • SHA1

      ec2a833e84421dfc2159a4269bdbc2e6ba7398c8

    • SHA256

      743aecdb6460a4cb67017707c2c5280e4d9245056de9abafc7b99547729411b1

    • SHA512

      81d45252a91c8aa9a25b7d2f33533b280876ec127cf6f68d2c1a9c7438d5746154536f030b0145dad35ed78c15e802d51a2ea87dc8808796399c3d7ba9876f2f

    • SSDEEP

      6144:iyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:iCemx0vN3HKGi6sYjJLUGGtedud5tr7

    Score
    8/10
    adwarediscoveryexploitpersistencestealer

    • Drops file in Drivers directory

    • Possible privilege escalation attempt

      exploit

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Modifies file permissions

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks