dfdf4d0abe9bd5cfae89bae8b8d54acb8588ff008b77558b73848b6ffd7a727f

General

Target

NEAS.301632a32e63f0053b8be72bbad73220_JC.exe
Size

736KB
MD5

301632a32e63f0053b8be72bbad73220
SHA1

cf3c53b4a8ab4665ae07f938f133f2945074b00c
SHA256

dfdf4d0abe9bd5cfae89bae8b8d54acb8588ff008b77558b73848b6ffd7a727f
SHA512

7057f33c9ade30670fa305a626cd3bb847b1e604a7b07d8ce8a0bb4591f3974efb23c25e91f29adfcffd17ebfc5423f8c15eb71462bd6f4d893bbae4343fa944
SSDEEP

12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdzY3yD25uNlE:P1/aGLDCM4D8ayGMZo8/PY3yDfNlE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2232	icdfh.exe

Loads dropped DLL 2 IoCs

pid	Process
2080	NEAS.301632a32e63f0053b8be72bbad73220_JC.exe
2080	NEAS.301632a32e63f0053b8be72bbad73220_JC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\icdfh.exe"	icdfh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2232	2080	NEAS.301632a32e63f0053b8be72bbad73220_JC.exe	28
PID 2080 wrote to memory of 2232	2080	NEAS.301632a32e63f0053b8be72bbad73220_JC.exe	28
PID 2080 wrote to memory of 2232	2080	NEAS.301632a32e63f0053b8be72bbad73220_JC.exe	28
PID 2080 wrote to memory of 2232	2080	NEAS.301632a32e63f0053b8be72bbad73220_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.301632a32e63f0053b8be72bbad73220_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.301632a32e63f0053b8be72bbad73220_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080
- C:\ProgramData\icdfh.exe
  "C:\ProgramData\icdfh.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
736KB

MD5
77f2ac7569f58ad1cae7da9c8105a2b5

SHA1
68e50a509f49e2652042cc70c7f70ba084bb66b2

SHA256
078a5dcd55214356c422639dca2a61f1a5d4ed9255c68302d3ed205229b8a3d1

SHA512
e929f96d0a88ef23e1d9469026468af9df5264f530fe65cbc9e11a925e5e9537e788fff7e8d3ab9c32f0e4bd6d3bc49d6ed22879628e0ff3fc773f82b37ad417

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
70d6cb7dd01ebd5a21af02945d2ae12f

SHA1
05260b3e17a221e66b58d1e5ed1d0f518392159a

SHA256
136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

SHA512
b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
70d6cb7dd01ebd5a21af02945d2ae12f

SHA1
05260b3e17a221e66b58d1e5ed1d0f518392159a

SHA256
136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

SHA512
b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

Download Submit
C:\ProgramData\icdfh.exe

Filesize
258KB

MD5
fa1859fd8a000a5c87d90bb4c17cb9b4

SHA1
b2e1db700e7487a263a437f06a3f39fa49fb3641

SHA256
4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

SHA512
a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

Download Submit
C:\ProgramData\icdfh.exe

Filesize
258KB

MD5
fa1859fd8a000a5c87d90bb4c17cb9b4

SHA1
b2e1db700e7487a263a437f06a3f39fa49fb3641

SHA256
4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

SHA512
a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

Download Submit
C:\ProgramData\icdfh.exe

Filesize
258KB

MD5
fa1859fd8a000a5c87d90bb4c17cb9b4

SHA1
b2e1db700e7487a263a437f06a3f39fa49fb3641

SHA256
4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

SHA512
a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

Download Submit
\ProgramData\icdfh.exe

Filesize
258KB

MD5
fa1859fd8a000a5c87d90bb4c17cb9b4

SHA1
b2e1db700e7487a263a437f06a3f39fa49fb3641

SHA256
4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

SHA512
a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

Download Submit
\ProgramData\icdfh.exe

Filesize
258KB

MD5
fa1859fd8a000a5c87d90bb4c17cb9b4

SHA1
b2e1db700e7487a263a437f06a3f39fa49fb3641

SHA256
4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

SHA512
a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

Download Submit
memory/2080-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2232-102-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2232-1157-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads