Analysis

  • max time kernel
    118s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 08:22

General

  • Target

    NEAS.10ab83fbee7c5b815d805dde94051ab0.exe

  • Size

    1.1MB

  • MD5

    10ab83fbee7c5b815d805dde94051ab0

  • SHA1

    773cb6945ffae3c55051ea73ceb8f529cc928e2d

  • SHA256

    37a503f7d36bda3be968b6cb557bae0735f56b14579000519b7418fbc68a9fab

  • SHA512

    142c2e23ca60b2ad7dfb1f4977216c24b0917498cdb4761f45100bef60a5e56e513d2d951472815e62c7b8fadab88ffd41cccaff64fdb34fea2b284bf70a8272

  • SSDEEP

    24576:2SjPD9TNj8cZhrJd9YKkinOlbsMlPjz3dXhQChtNsB:2MNjvhNdGKkinOlxdrrQCjNu

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.10ab83fbee7c5b815d805dde94051ab0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.10ab83fbee7c5b815d805dde94051ab0.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2292

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2292-1-0x00000000004E0000-0x0000000000540000-memory.dmp

          Filesize

          384KB

        • memory/2292-0-0x0000000140000000-0x0000000140125000-memory.dmp

          Filesize

          1.1MB

        • memory/2292-8-0x00000000004E0000-0x0000000000540000-memory.dmp

          Filesize

          384KB

        • memory/2292-7-0x00000000004E0000-0x0000000000540000-memory.dmp

          Filesize

          384KB

        • memory/2292-12-0x00000000004E0000-0x0000000000540000-memory.dmp

          Filesize

          384KB

        • memory/2292-14-0x0000000140000000-0x0000000140125000-memory.dmp

          Filesize

          1.1MB