a0b31406c25e0533efc68a0cd1023e7bf0b7d2efd7f829d51d1953721ca4b0e1

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.d3361da06cd587144d52d92ad1db72e0.exe
Size

887KB
MD5

d3361da06cd587144d52d92ad1db72e0
SHA1

0f4b929e7065bb69651ac6c45c127e3064392e78
SHA256

a0b31406c25e0533efc68a0cd1023e7bf0b7d2efd7f829d51d1953721ca4b0e1
SHA512

2a84c11fd8aa6b38dbd7c9775c12373ce2c04c31c82cb83d763195c21bf279ef162bf3c1e7215fca5e8482d238a1ce3bed755449c44d1b42baf6cdda12cda12e
SSDEEP

24576:1D16eB79ccc7cP/bDHHIp04rgZx9A7uDIVzWDJD1QB/1E3U+dmFOJlnC8UcccvXw:1D16eBhccc7cP/bDHHIp04rgZx9A7uDs

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
896	NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Executes dropped EXE 1 IoCs

pid	Process
896	NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Loads dropped DLL 4 IoCs

pid	Process
2292	NEAS.d3361da06cd587144d52d92ad1db72e0.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	896	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2292	NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
896	NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 896	2292	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	29
PID 2292 wrote to memory of 896	2292	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	29
PID 2292 wrote to memory of 896	2292	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	29
PID 2292 wrote to memory of 896	2292	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	29
PID 896 wrote to memory of 1708	896	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	30
PID 896 wrote to memory of 1708	896	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	30
PID 896 wrote to memory of 1708	896	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	30
PID 896 wrote to memory of 1708	896	NEAS.d3361da06cd587144d52d92ad1db72e0.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 144
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Filesize
887KB

MD5
9a8a5f15b3c420ec6271f9ab141386e0

SHA1
cfb49e240b0cbd9ed8b8b63fcee27e826edc3170

SHA256
c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f

SHA512
d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Filesize
887KB

MD5
9a8a5f15b3c420ec6271f9ab141386e0

SHA1
cfb49e240b0cbd9ed8b8b63fcee27e826edc3170

SHA256
c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f

SHA512
d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Filesize
887KB

MD5
9a8a5f15b3c420ec6271f9ab141386e0

SHA1
cfb49e240b0cbd9ed8b8b63fcee27e826edc3170

SHA256
c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f

SHA512
d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Filesize
887KB

MD5
9a8a5f15b3c420ec6271f9ab141386e0

SHA1
cfb49e240b0cbd9ed8b8b63fcee27e826edc3170

SHA256
c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f

SHA512
d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe

Filesize
887KB

MD5
9a8a5f15b3c420ec6271f9ab141386e0

SHA1
cfb49e240b0cbd9ed8b8b63fcee27e826edc3170

SHA256
c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f

SHA512
d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea

Download Submit
memory/896-10-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/896-11-0x0000000002E50000-0x0000000002F3D000-memory.dmp

Filesize
948KB

Download
memory/896-15-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2292-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2292-6-0x00000000030A0000-0x000000000318D000-memory.dmp

Filesize
948KB

Download
memory/2292-8-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download