Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2023 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.8a609f10767734827cdd80a91255dd70.exe
Resource
win7-20231023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.8a609f10767734827cdd80a91255dd70.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
NEAS.8a609f10767734827cdd80a91255dd70.exe
-
Size
3.1MB
-
MD5
8a609f10767734827cdd80a91255dd70
-
SHA1
e00005de69a9e7639a30d5006194ab0101d9e42a
-
SHA256
0c3c478f128db4164a598be80cc99fed93ebc38c9e91ddf2565e9cc4161c0565
-
SHA512
2eaab368d2ddf42b830e65e8f0acdf4a5a735d7420c5f8a55e8c17d62cc015a2b5801695fe3a2489c562a7fdf81717bbfb7484e13d823f7fec74695676bf4020
-
SSDEEP
49152:qymcv3K3uqx1y9ZpVS/HpaR95EKhdl7FVFbbQGJqBzCsfoE9cCB/Q:qyD3MuqfSW2X3hLB7UzdAEm+Q
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\NEAS.8a609f10767734827cdd80a91255dd70.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.8a609f10767734827cdd80a91255dd70.exe" NEAS.8a609f10767734827cdd80a91255dd70.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3232 NEAS.8a609f10767734827cdd80a91255dd70.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8a609f10767734827cdd80a91255dd70.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8a609f10767734827cdd80a91255dd70.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3232