df004d7d3dd8bea0727758453d1052aa8f7e2223c257f90e889d028df668b3df

General

Target

NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Size

132KB
MD5

01f6fdfc821b0eeb18aa40e4f4184630
SHA1

4b9fa99b9e6a24b9cb92ad334a46c96bd8772ce3
SHA256

df004d7d3dd8bea0727758453d1052aa8f7e2223c257f90e889d028df668b3df
SHA512

96b699fdd2693e99e2f12a37aa66ad09dbf1d31d3513cbd97e85a4295cdbd21aaf91e3036f120ae5f84c2ef5db6f2929624d8b7e372f45078f41b7f2190986d4
SSDEEP

3072:Gsyf6cnzFY2voUwS38nLZEw199ZQPWPJK6GervT5VJJyWS0:dJczG2QjS3g6ybr7XW0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\ = "STMEdi Document"	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\printto\command	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.stm	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.stm\ShellNew\NullFile	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\DefaultIcon	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\open	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\print\command	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS01~1.EXE,0"	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\open\command	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\printto	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.stm\ = "STMEditor.Document"	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.stm\ShellNew	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS01~1.EXE \"%1\""	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\print	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS01~1.EXE /p \"%1\""	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\STMEditor.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS01~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28
PID 1720 wrote to memory of 1712	1720	NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.01f6fdfc821b0eeb18aa40e4f4184630_JC.exe
  2⤵
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1712-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1720-0-0x00000000003E0000-0x00000000003E4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads