Analysis
-
max time kernel
176s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 08:57
Behavioral task
behavioral1
Sample
NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll
Resource
win7-20231023-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll
Resource
win10v2004-20231025-en
4 signatures
150 seconds
General
-
Target
NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll
-
Size
76KB
-
MD5
cbeb89af78888b315b83b61e5c02bdf0
-
SHA1
0ac2ac1c810e7e9ef9a97b72a8b68e501ca1ab5c
-
SHA256
491788b90c5dd2de5da996020eef792aa68fd6a20f085dff5558194760c082fe
-
SHA512
b6dab2f1a6c99ddacc171f4476e66d48be78aabe7e590c3fa426daff8b0f570ae4ea61945ebc956f01a7e7e98e9a0779533b6ce63d0b2489a80676733f1651c5
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZekO/W62:c8y93KQjy7G55riF1cMo03okOE
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral1/memory/2728-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2728-1-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2728-2-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2728-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2728-4-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2728 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2728 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2728 2620 rundll32.exe 29 PID 2620 wrote to memory of 2728 2620 rundll32.exe 29 PID 2620 wrote to memory of 2728 2620 rundll32.exe 29 PID 2620 wrote to memory of 2728 2620 rundll32.exe 29 PID 2620 wrote to memory of 2728 2620 rundll32.exe 29 PID 2620 wrote to memory of 2728 2620 rundll32.exe 29 PID 2620 wrote to memory of 2728 2620 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cbeb89af78888b315b83b61e5c02bdf0_JC.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-