aa723f86bd0a2ba235b7422e8956ec88a6b0eb389d43e919875253b9e0465d52

Analysis

max time kernel
151s
max time network
151s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
Size

209KB
MD5

da17f83d947f741ec61df2a41182b1d0
SHA1

c62ed6ecf822fa1cbd194577b644fcaa4129d34e
SHA256

aa723f86bd0a2ba235b7422e8956ec88a6b0eb389d43e919875253b9e0465d52
SHA512

478f82cab4cc9a7be3f9bc05daab88f41355ac485bef702ee6ce6470871677ad55ada018b675590caa0e3925940b0b59390a5d2d683777d0ce7393cfad003ccb
SSDEEP

3072:rQcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:rQh9tVRm2kh34hdeCkcG7DEALLlnN

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
2360	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-1-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2360-16-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2448-18-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2448-40-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\6f806792 = "C:\\Windows\\apppatch\\svchost.exe"	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\6f806792 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe
2448	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2360	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2448	2360	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe	28
PID 2360 wrote to memory of 2448	2360	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe	28
PID 2360 wrote to memory of 2448	2360	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe	28
PID 2360 wrote to memory of 2448	2360	NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
ca9de96320480328f2a5699f3bfd501a

SHA1
b07491f18bb1909dc2600ff9befc0283ca3d32d5

SHA256
b5af2cdf11e639906f4dc057de44fdde2376c6a4f1b0d414f17d8c49be0f1d08

SHA512
396a14aa93dae00b984a658cdf7dd51950098507b3eb71e94c366575591ba053a43329907558cffba39ab1c238ab38a9ba74f469909ef013e010e76e277cb5fa

Download Submit
C:\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
ca9de96320480328f2a5699f3bfd501a

SHA1
b07491f18bb1909dc2600ff9befc0283ca3d32d5

SHA256
b5af2cdf11e639906f4dc057de44fdde2376c6a4f1b0d414f17d8c49be0f1d08

SHA512
396a14aa93dae00b984a658cdf7dd51950098507b3eb71e94c366575591ba053a43329907558cffba39ab1c238ab38a9ba74f469909ef013e010e76e277cb5fa

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
209KB

MD5
ca9de96320480328f2a5699f3bfd501a

SHA1
b07491f18bb1909dc2600ff9befc0283ca3d32d5

SHA256
b5af2cdf11e639906f4dc057de44fdde2376c6a4f1b0d414f17d8c49be0f1d08

SHA512
396a14aa93dae00b984a658cdf7dd51950098507b3eb71e94c366575591ba053a43329907558cffba39ab1c238ab38a9ba74f469909ef013e010e76e277cb5fa

Download Submit
\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
ca9de96320480328f2a5699f3bfd501a

SHA1
b07491f18bb1909dc2600ff9befc0283ca3d32d5

SHA256
b5af2cdf11e639906f4dc057de44fdde2376c6a4f1b0d414f17d8c49be0f1d08

SHA512
396a14aa93dae00b984a658cdf7dd51950098507b3eb71e94c366575591ba053a43329907558cffba39ab1c238ab38a9ba74f469909ef013e010e76e277cb5fa

Download Submit
\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
ca9de96320480328f2a5699f3bfd501a

SHA1
b07491f18bb1909dc2600ff9befc0283ca3d32d5

SHA256
b5af2cdf11e639906f4dc057de44fdde2376c6a4f1b0d414f17d8c49be0f1d08

SHA512
396a14aa93dae00b984a658cdf7dd51950098507b3eb71e94c366575591ba053a43329907558cffba39ab1c238ab38a9ba74f469909ef013e010e76e277cb5fa

Download Submit
memory/2360-0-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2360-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2360-15-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2360-16-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2448-19-0x0000000001C80000-0x0000000001D0A000-memory.dmp

Filesize
552KB

Download
memory/2448-31-0x00000000023C0000-0x0000000002459000-memory.dmp

Filesize
612KB

Download
memory/2448-21-0x0000000001C80000-0x0000000001D0A000-memory.dmp

Filesize
552KB

Download
memory/2448-23-0x0000000001C80000-0x0000000001D0A000-memory.dmp

Filesize
552KB

Download
memory/2448-25-0x0000000001C80000-0x0000000001D0A000-memory.dmp

Filesize
552KB

Download
memory/2448-27-0x0000000001C80000-0x0000000001D0A000-memory.dmp

Filesize
552KB

Download
memory/2448-29-0x0000000001C80000-0x0000000001D0A000-memory.dmp

Filesize
552KB

Download
memory/2448-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2448-33-0x00000000023C0000-0x0000000002459000-memory.dmp

Filesize
612KB

Download
memory/2448-34-0x00000000023C0000-0x0000000002459000-memory.dmp

Filesize
612KB

Download
memory/2448-35-0x00000000023C0000-0x0000000002459000-memory.dmp

Filesize
612KB

Download
memory/2448-17-0x00000000004E0000-0x0000000000538000-memory.dmp

Filesize
352KB

Download
memory/2448-39-0x00000000023C0000-0x0000000002459000-memory.dmp

Filesize
612KB

Download
memory/2448-40-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download