2611edeaef75a1f147ef8adda0da5313d3f767dc02b8fd3531bfa7e1b52090c6

Analysis

max time kernel
111s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.463be9075c7c655cb0314b4bebb8d920.exe
Size

242KB
MD5

463be9075c7c655cb0314b4bebb8d920
SHA1

73781b8afbc1af3d88c05b83112790cf59c12e0f
SHA256

2611edeaef75a1f147ef8adda0da5313d3f767dc02b8fd3531bfa7e1b52090c6
SHA512

5167f38102ee63abde2a2b613e7b82822bfeea8f29629153f93db54c930ce0aaba2deb32c6a4608acf051ec5016d1c04b11ce0a0f15715092586b6944ca8e3f2
SSDEEP

6144:aY6ToLMce4BBWix5kmU2wjJSw/PNmXZiQmv5jBS9Wdq/Gi:aY6ToLMce4uixGqw9FPNItmtMIdq/X

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe

Executes dropped EXE 1 IoCs

pid	Process
1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe
1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1664	NEAS.463be9075c7c655cb0314b4bebb8d920.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1664	NEAS.463be9075c7c655cb0314b4bebb8d920.exe
1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1384	1664	NEAS.463be9075c7c655cb0314b4bebb8d920.exe	89
PID 1664 wrote to memory of 1384	1664	NEAS.463be9075c7c655cb0314b4bebb8d920.exe	89
PID 1664 wrote to memory of 1384	1664	NEAS.463be9075c7c655cb0314b4bebb8d920.exe	89
PID 1384 wrote to memory of 4284	1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe	92
PID 1384 wrote to memory of 4284	1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe	92
PID 1384 wrote to memory of 4284	1384	NEAS.463be9075c7c655cb0314b4bebb8d920.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.463be9075c7c655cb0314b4bebb8d920.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.463be9075c7c655cb0314b4bebb8d920.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\NEAS.463be9075c7c655cb0314b4bebb8d920.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.463be9075c7c655cb0314b4bebb8d920.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\NEAS.463be9075c7c655cb0314b4bebb8d920.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.463be9075c7c655cb0314b4bebb8d920.exe

Filesize
242KB

MD5
7e643a44359aa7515c910fc5bba3485f

SHA1
9dbc05f75672f4b8d8703ead448dd9d1efaf047a

SHA256
48ca5e09f6ebad94efee4c2844fc0965ea723539531e58a4d4b9f592da7f25ae

SHA512
6e29984865ec037d76fb41a4d1a4aa3887c5a786b116c121f29b6e15e26de98a1d9b45326b0ded3899d0fd3552eb26ffaa01a7273972c2ef94adc00067fbe389

Download Submit
memory/1384-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1384-15-0x0000000001670000-0x0000000001727000-memory.dmp

Filesize
732KB

Download
memory/1384-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1384-20-0x0000000004F30000-0x0000000004F96000-memory.dmp

Filesize
408KB

Download
memory/1384-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1384-27-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1664-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1664-1-0x0000000001530000-0x00000000015E7000-memory.dmp

Filesize
732KB

Download
memory/1664-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1664-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download