6474033eadd2a6dbce0e10902561eb08d6016299c251b19e1932f682a6feea3c

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
Size

551KB
MD5

004ca26b7e5c8fab984c3ca1662dc3a0
SHA1

632be881ad6038d2ac7f6184e25abbb12404de99
SHA256

6474033eadd2a6dbce0e10902561eb08d6016299c251b19e1932f682a6feea3c
SHA512

34b8bd54d149e203c74b4829dba10bc547b286807f8cc52d09fe53ed917f302620d67c992d2c4f67570c51fff1486f78051f6effd836d1618946b1129e99c709
SSDEEP

6144:gxjgyEK8V6vqgUqGFbfalZE0xsgvIURmbkq79Bi7t4/9FAwscVJJGUdAUatLM:ign+vcOwEIU4B79BiY5suGU+5tLM

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 372	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	24
PID 1408 wrote to memory of 372	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	24
PID 1408 wrote to memory of 372	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	24
PID 1408 wrote to memory of 372	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	24
PID 1408 wrote to memory of 372	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	24
PID 1408 wrote to memory of 372	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	24
PID 1408 wrote to memory of 372	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	24
PID 1408 wrote to memory of 388	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	23
PID 1408 wrote to memory of 388	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	23
PID 1408 wrote to memory of 388	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	23
PID 1408 wrote to memory of 388	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	23
PID 1408 wrote to memory of 388	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	23
PID 1408 wrote to memory of 388	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	23
PID 1408 wrote to memory of 388	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	23
PID 1408 wrote to memory of 424	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	22
PID 1408 wrote to memory of 424	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	22
PID 1408 wrote to memory of 424	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	22
PID 1408 wrote to memory of 424	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	22
PID 1408 wrote to memory of 424	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	22
PID 1408 wrote to memory of 424	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	22
PID 1408 wrote to memory of 424	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	22
PID 1408 wrote to memory of 468	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	21
PID 1408 wrote to memory of 468	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	21
PID 1408 wrote to memory of 468	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	21
PID 1408 wrote to memory of 468	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	21
PID 1408 wrote to memory of 468	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	21
PID 1408 wrote to memory of 468	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	21
PID 1408 wrote to memory of 468	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	21
PID 1408 wrote to memory of 484	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	20
PID 1408 wrote to memory of 484	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	20
PID 1408 wrote to memory of 484	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	20
PID 1408 wrote to memory of 484	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	20
PID 1408 wrote to memory of 484	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	20
PID 1408 wrote to memory of 484	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	20
PID 1408 wrote to memory of 484	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	20
PID 1408 wrote to memory of 492	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	19
PID 1408 wrote to memory of 492	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	19
PID 1408 wrote to memory of 492	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	19
PID 1408 wrote to memory of 492	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	19
PID 1408 wrote to memory of 492	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	19
PID 1408 wrote to memory of 492	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	19
PID 1408 wrote to memory of 492	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	19
PID 1408 wrote to memory of 604	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	18
PID 1408 wrote to memory of 604	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	18
PID 1408 wrote to memory of 604	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	18
PID 1408 wrote to memory of 604	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	18
PID 1408 wrote to memory of 604	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	18
PID 1408 wrote to memory of 604	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	18
PID 1408 wrote to memory of 604	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	18
PID 1408 wrote to memory of 684	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	17
PID 1408 wrote to memory of 684	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	17
PID 1408 wrote to memory of 684	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	17
PID 1408 wrote to memory of 684	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	17
PID 1408 wrote to memory of 684	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	17
PID 1408 wrote to memory of 684	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	17
PID 1408 wrote to memory of 684	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	17
PID 1408 wrote to memory of 748	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	16
PID 1408 wrote to memory of 748	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	16
PID 1408 wrote to memory of 748	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	16
PID 1408 wrote to memory of 748	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	16
PID 1408 wrote to memory of 748	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	16
PID 1408 wrote to memory of 748	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	16
PID 1408 wrote to memory of 748	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	16
PID 1408 wrote to memory of 820	1408	NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe	15

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2152

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1976

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1292
- C:\Users\Admin\AppData\Local\Temp\NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.004ca26b7e5c8fab984c3ca1662dc3a0_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1232

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:604

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-0-0x0000000001000000-0x000000000108C000-memory.dmp

Filesize
560KB

Download
memory/1408-2-0x00000000778E0000-0x00000000778E1000-memory.dmp

Filesize
4KB

Download
memory/1408-1-0x00000000778DF000-0x00000000778E0000-memory.dmp

Filesize
4KB

Download
memory/1408-3-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download
memory/1408-4-0x0000000001000000-0x000000000108C000-memory.dmp

Filesize
560KB

Download