b5ed70b476779b394767fea246dbd7c485c1b4d1d1615ed188d6c86c5ee06749

Analysis

max time kernel
157s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.64c74017c516766686e28b6ad7b67650.exe
Size

257KB
MD5

64c74017c516766686e28b6ad7b67650
SHA1

970e5d8e68ce545209cde40e32cb8c9d90d702e1
SHA256

b5ed70b476779b394767fea246dbd7c485c1b4d1d1615ed188d6c86c5ee06749
SHA512

fec0486c37cef7287870e748d3976fa8b65adea4f65f09a90a96c49519bc69f2622d82ee461a4611ee591aa76d43cb6ded9a8abd1d1fa52dd9258047209efc06
SSDEEP

6144:lSBePu+AeHzWM3FObg6ytRWbYjBWS7zMas+d+:woPjAeHzt4VytRWMjBp/Mas+c

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2412	NEAS.64c74017c516766686e28b6ad7b67650.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	NEAS.64c74017c516766686e28b6ad7b67650.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2412	NEAS.64c74017c516766686e28b6ad7b67650.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	NEAS.64c74017c516766686e28b6ad7b67650.exe
2412	NEAS.64c74017c516766686e28b6ad7b67650.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2444	NEAS.64c74017c516766686e28b6ad7b67650.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2444	NEAS.64c74017c516766686e28b6ad7b67650.exe
2412	NEAS.64c74017c516766686e28b6ad7b67650.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2412	2444	NEAS.64c74017c516766686e28b6ad7b67650.exe	88
PID 2444 wrote to memory of 2412	2444	NEAS.64c74017c516766686e28b6ad7b67650.exe	88
PID 2444 wrote to memory of 2412	2444	NEAS.64c74017c516766686e28b6ad7b67650.exe	88
PID 2412 wrote to memory of 4084	2412	NEAS.64c74017c516766686e28b6ad7b67650.exe	91
PID 2412 wrote to memory of 4084	2412	NEAS.64c74017c516766686e28b6ad7b67650.exe	91
PID 2412 wrote to memory of 4084	2412	NEAS.64c74017c516766686e28b6ad7b67650.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.64c74017c516766686e28b6ad7b67650.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.64c74017c516766686e28b6ad7b67650.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\NEAS.64c74017c516766686e28b6ad7b67650.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.64c74017c516766686e28b6ad7b67650.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\NEAS.64c74017c516766686e28b6ad7b67650.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.64c74017c516766686e28b6ad7b67650.exe

Filesize
257KB

MD5
80aa9ef85a2386642ca44101da0f4f17

SHA1
2de49181e8b0e43c3d583c19d8dd8a51b0e89884

SHA256
bd56e8355c3aad658d6b019d29bc546dee33d143ceab927ab505efca18dda3e3

SHA512
e6a0fb52b5a4d9dcd07eeea17fcadb5458a286ab0876ae2c2ead29c167ab77511993fa02b5b3655b994721f20b19e919859bcd52cd415017a6b04e376c84f00c

Download Submit
memory/2412-13-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2412-14-0x00000000014C0000-0x0000000001578000-memory.dmp

Filesize
736KB

Download
memory/2412-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2412-20-0x00000000016B0000-0x0000000001717000-memory.dmp

Filesize
412KB

Download
memory/2412-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2412-27-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2444-0-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2444-1-0x0000000001620000-0x00000000016D8000-memory.dmp

Filesize
736KB

Download
memory/2444-2-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2444-11-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download