Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
03-11-2023 08:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.50da21273994bc76d5d94beac5a04930.exe
Resource
win7-20231020-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.50da21273994bc76d5d94beac5a04930.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
NEAS.50da21273994bc76d5d94beac5a04930.exe
-
Size
502KB
-
MD5
50da21273994bc76d5d94beac5a04930
-
SHA1
36d42ec79e7285bce3f82c5d35c1732007804182
-
SHA256
307689f1f08fe0cac2777b117b477245df955a18520eadb5eb3160bb6be27f71
-
SHA512
bc62574b3b59d765a0f5092747ee7674169856e9e528030f36af5b9e96867cf9ff0f59cf87c8fed069fc7e48b7f53bc5dffca09049272ce85fcf410453a7a205
-
SSDEEP
12288:sytbV3kSoXaLnToslwFXj7jZU1al0z2oIO:3b5kSYaLTVlIXjhflDpO
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1144 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2120 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1452 NEAS.50da21273994bc76d5d94beac5a04930.exe 1452 NEAS.50da21273994bc76d5d94beac5a04930.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1452 NEAS.50da21273994bc76d5d94beac5a04930.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1452 wrote to memory of 1144 1452 NEAS.50da21273994bc76d5d94beac5a04930.exe 28 PID 1452 wrote to memory of 1144 1452 NEAS.50da21273994bc76d5d94beac5a04930.exe 28 PID 1452 wrote to memory of 1144 1452 NEAS.50da21273994bc76d5d94beac5a04930.exe 28 PID 1144 wrote to memory of 2120 1144 cmd.exe 30 PID 1144 wrote to memory of 2120 1144 cmd.exe 30 PID 1144 wrote to memory of 2120 1144 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.50da21273994bc76d5d94beac5a04930.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.50da21273994bc76d5d94beac5a04930.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\NEAS.50da21273994bc76d5d94beac5a04930.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2120
-
-