af60c583f2a65e31cd11f7dc7dbd35a1302f41d3fd6809f087757805071da0c4

Analysis

max time kernel
138s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b7bd79690ddc5dc36b49296f93eea920.exe
Size

202KB
MD5

b7bd79690ddc5dc36b49296f93eea920
SHA1

0857e813ed363efb424b9e38a69906cb8e111266
SHA256

af60c583f2a65e31cd11f7dc7dbd35a1302f41d3fd6809f087757805071da0c4
SHA512

86c094882d717ae4d7b4d47004095b6dd6cc03bf25973f24a12be0f9d572638be5a4707622401c23b1b6c58d400d75151442b03aa96dd8f7ec01ec76f90bbbfe
SSDEEP

3072:06oGO9DJdnPfvnM3YzRZgGkmTTZ9nLqsKMt9oseV2gXbrIQqmPOyCc1:0XVP3Mu0mnZlLvKyyV2gLSnU

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3936	giuchbl.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\giuchbl.exe	NEAS.b7bd79690ddc5dc36b49296f93eea920.exe
File created	C:\PROGRA~3\Mozilla\nxsukhg.dll	giuchbl.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.b7bd79690ddc5dc36b49296f93eea920.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b7bd79690ddc5dc36b49296f93eea920.exe"
1⤵
- Drops file in Program Files directory
PID:3468

C:\PROGRA~3\Mozilla\giuchbl.exe
C:\PROGRA~3\Mozilla\giuchbl.exe -tvuydyl
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\giuchbl.exe

Filesize
202KB

MD5
f8f071051809bbc1ef0d086eb69ba920

SHA1
8f370cd0b9b2e106b7f292fe6585ec90665415c1

SHA256
d40ef6eb0dcaf7d11c7a420fd2be1c61459aa3557ff1894c1dd5637704bc3c87

SHA512
4d81d00873ecd0448833447ac32a52774c4556f0806e59d7c73ea2d3d3e747df6dc71c135c0f7e5c33070fe93419f40ad7e8b0d620e706f2107854b746d11c74

Download Submit
C:\ProgramData\Mozilla\giuchbl.exe

Filesize
202KB

MD5
f8f071051809bbc1ef0d086eb69ba920

SHA1
8f370cd0b9b2e106b7f292fe6585ec90665415c1

SHA256
d40ef6eb0dcaf7d11c7a420fd2be1c61459aa3557ff1894c1dd5637704bc3c87

SHA512
4d81d00873ecd0448833447ac32a52774c4556f0806e59d7c73ea2d3d3e747df6dc71c135c0f7e5c33070fe93419f40ad7e8b0d620e706f2107854b746d11c74

Download Submit
memory/3468-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3468-2-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3468-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/3468-4-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3468-9-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3936-11-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3936-17-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download