Analysis
-
max time kernel
170s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
02-11-2023 16:53
General
-
Target
NEAS.fe1c3c0b4be74cf852f746aeff1cc100.exe
-
Size
484KB
-
MD5
fe1c3c0b4be74cf852f746aeff1cc100
-
SHA1
15f66c596c9f0ba48f98bfd96ad3808b03ad9ad5
-
SHA256
a75561e113ce8537e0789d9977fbd8a3b78523688d5c1b41e6ffa95dd643a04d
-
SHA512
2bff1731bf52a0edbf954f1ebf30cb856cdf13a2fffd6947ff8d688b45ffd1fee8129c5aba8f94c31794787bd8f58ebedb4eb39dba65d1e5e270b48828678dac
-
SSDEEP
12288:WLPkCDt1EG2XVekhdeT24ggUymS2VgJiGy4sYS:WLPkQ1bqAu4iymS7o4tS
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fe1c3c0b4be74cf852f746aeff1cc100.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fe1c3c0b4be74cf852f746aeff1cc100.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explabel\Packance.exe"C:\Users\Admin\AppData\Roaming\explabel"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~58C9.tmp3280 496136 4304 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 6203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\bitsrmap.exeC:\Windows\SysWOW64\bitsrmap.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3852 -ip 38521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
484KB
MD5cbef27cd6b733e1382bbbc75da26b045
SHA16a558519e1b2cd4b26f40b4d18383e800cfb92f7
SHA256451f1444f081399035a8abe49ee4b0584ea0a24e365160b45dc78735cd6a3fe6
SHA5120729e1e2335c98e84565684ef34cdfb12797f6769f9f6864a13200d2481092e854bd3ca18ac79c95276a2333daa98ce6a115704261f8ce8e575b23ad70d26901
-
Filesize
484KB
MD5cbef27cd6b733e1382bbbc75da26b045
SHA16a558519e1b2cd4b26f40b4d18383e800cfb92f7
SHA256451f1444f081399035a8abe49ee4b0584ea0a24e365160b45dc78735cd6a3fe6
SHA5120729e1e2335c98e84565684ef34cdfb12797f6769f9f6864a13200d2481092e854bd3ca18ac79c95276a2333daa98ce6a115704261f8ce8e575b23ad70d26901
-
Filesize
484KB
MD5cbef27cd6b733e1382bbbc75da26b045
SHA16a558519e1b2cd4b26f40b4d18383e800cfb92f7
SHA256451f1444f081399035a8abe49ee4b0584ea0a24e365160b45dc78735cd6a3fe6
SHA5120729e1e2335c98e84565684ef34cdfb12797f6769f9f6864a13200d2481092e854bd3ca18ac79c95276a2333daa98ce6a115704261f8ce8e575b23ad70d26901
-
Filesize
484KB
MD5cbef27cd6b733e1382bbbc75da26b045
SHA16a558519e1b2cd4b26f40b4d18383e800cfb92f7
SHA256451f1444f081399035a8abe49ee4b0584ea0a24e365160b45dc78735cd6a3fe6
SHA5120729e1e2335c98e84565684ef34cdfb12797f6769f9f6864a13200d2481092e854bd3ca18ac79c95276a2333daa98ce6a115704261f8ce8e575b23ad70d26901
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
524KB