a6d19b5da9e8ec9e8c91b11a84e9a2a5fade09a0c88e8ea599d3a0c2a90d085f

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.dcb8b38d1dc0cc7c4b38acf020195ec0.exe
Size

195KB
MD5

dcb8b38d1dc0cc7c4b38acf020195ec0
SHA1

40ff738a04a16dd1f00270b75e726eaea743e6f8
SHA256

a6d19b5da9e8ec9e8c91b11a84e9a2a5fade09a0c88e8ea599d3a0c2a90d085f
SHA512

106f27ab56bf4d14deac18e2cc066d5d0228ecea04e2072d3e38764cf68b89bcd614dfcf7f2b355f7fe2a1da506081cc343a0b75bdc142eda4306f1cc950bcd3
SSDEEP

3072:7mLy5XClqNrbPY4oLonnMXZKdujCa5BQbXHQSOydRmTgpZWYS2jbxWGqJslN:7w2ylq+b8nnUKAQbXHN1gWXSbGqJwN

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2732	dhuqaed.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\dhuqaed.exe	NEAS.dcb8b38d1dc0cc7c4b38acf020195ec0.exe
File created	C:\PROGRA~3\Mozilla\fjgblbm.dll	dhuqaed.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2040	NEAS.dcb8b38d1dc0cc7c4b38acf020195ec0.exe
2732	dhuqaed.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2732	2476	taskeng.exe	31
PID 2476 wrote to memory of 2732	2476	taskeng.exe	31
PID 2476 wrote to memory of 2732	2476	taskeng.exe	31
PID 2476 wrote to memory of 2732	2476	taskeng.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.dcb8b38d1dc0cc7c4b38acf020195ec0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dcb8b38d1dc0cc7c4b38acf020195ec0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2040

C:\Windows\system32\taskeng.exe
taskeng.exe {DC0733A2-87D8-431F-8958-655F7B00B5C9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\PROGRA~3\Mozilla\dhuqaed.exe
  C:\PROGRA~3\Mozilla\dhuqaed.exe -vpwggce
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\dhuqaed.exe

Filesize
195KB

MD5
02a4153696fed8f2a53830daa2e75be6

SHA1
2fbbb294ee5e737a602790a198ecb31382157854

SHA256
d9f23f73e3ed8fcccaa824b3b7e8eeb2073e77aac8a0303c59a160964fc90a29

SHA512
c2c428460a724d60a4669dd4bd6a8b7b2d59ead924518b176046dd1af8418b397ec9c47337e2001ac939369b5fdc61562533e3b176dcab0999d8524356368f04

Download Submit
C:\PROGRA~3\Mozilla\dhuqaed.exe

Filesize
195KB

MD5
02a4153696fed8f2a53830daa2e75be6

SHA1
2fbbb294ee5e737a602790a198ecb31382157854

SHA256
d9f23f73e3ed8fcccaa824b3b7e8eeb2073e77aac8a0303c59a160964fc90a29

SHA512
c2c428460a724d60a4669dd4bd6a8b7b2d59ead924518b176046dd1af8418b397ec9c47337e2001ac939369b5fdc61562533e3b176dcab0999d8524356368f04

Download Submit
memory/2040-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2040-2-0x0000000000260000-0x00000000002BC000-memory.dmp

Filesize
368KB

Download
memory/2040-4-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2040-6-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2040-7-0x0000000000260000-0x00000000002BC000-memory.dmp

Filesize
368KB

Download
memory/2040-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2040-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2040-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2040-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2732-12-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2732-13-0x00000000008C0000-0x000000000091C000-memory.dmp

Filesize
368KB

Download
memory/2732-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2732-16-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2732-17-0x00000000008C0000-0x000000000091C000-memory.dmp

Filesize
368KB

Download