b43522bb6e35052123378ebf6cfe017c0dace4430c71cad89b6d90e7cde5f4c8

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.5def1dfc96cf89abda6747f3f24fdec0.exe
Size

181KB
MD5

5def1dfc96cf89abda6747f3f24fdec0
SHA1

9adc82885fb973641580d24dd3f0fd95d1486d8a
SHA256

b43522bb6e35052123378ebf6cfe017c0dace4430c71cad89b6d90e7cde5f4c8
SHA512

1983be05987cdb16fefd73cee7dcd9e18d2791950e14c74d9de5a3c0debc7ad182c2e7330f69327339260843892275df2cd32b823b120333ec39e6a0a5158879
SSDEEP

3072:YG9WdoX/14GwN+iHhK/xYHeAvG4HTQSKsTRbjpu5kS6AF+mheuxRO0Vrs:D9WG14GWx2xYnIstbjgHESeuz5s

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2384	dhuqaed.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\dhuqaed.exe	NEAS.5def1dfc96cf89abda6747f3f24fdec0.exe
File created	C:\PROGRA~3\Mozilla\fjgblbm.dll	dhuqaed.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2384	2888	taskeng.exe	29
PID 2888 wrote to memory of 2384	2888	taskeng.exe	29
PID 2888 wrote to memory of 2384	2888	taskeng.exe	29
PID 2888 wrote to memory of 2384	2888	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.5def1dfc96cf89abda6747f3f24fdec0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5def1dfc96cf89abda6747f3f24fdec0.exe"
1⤵
- Drops file in Program Files directory
PID:2496

C:\Windows\system32\taskeng.exe
taskeng.exe {A259B0CA-D17B-493C-9C0E-CF12A3B2C1E7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\PROGRA~3\Mozilla\dhuqaed.exe
  C:\PROGRA~3\Mozilla\dhuqaed.exe -vpwggce
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\dhuqaed.exe

Filesize
181KB

MD5
4f39935ac5e3c37fbfe7f7cf941d880f

SHA1
f1f0549109ad278c6b2eb67e80c8c1b3bdc410e3

SHA256
3d99590e8eb24d60163a0d60b34d70c24b2d6fb10be1c5bdc45c1d214020a5c9

SHA512
3eb6762400130bd7c3fb9cecbacbb1c228ac2bb3146e54a7ca9fb1c624b77861535a358baf89619552cbc4e6dcb672238384f2b16f94aecae2769204163abb38

Download Submit
C:\PROGRA~3\Mozilla\dhuqaed.exe

Filesize
181KB

MD5
4f39935ac5e3c37fbfe7f7cf941d880f

SHA1
f1f0549109ad278c6b2eb67e80c8c1b3bdc410e3

SHA256
3d99590e8eb24d60163a0d60b34d70c24b2d6fb10be1c5bdc45c1d214020a5c9

SHA512
3eb6762400130bd7c3fb9cecbacbb1c228ac2bb3146e54a7ca9fb1c624b77861535a358baf89619552cbc4e6dcb672238384f2b16f94aecae2769204163abb38

Download Submit
memory/2384-10-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2384-11-0x0000000000220000-0x000000000027B000-memory.dmp

Filesize
364KB

Download
memory/2384-17-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2496-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2496-1-0x0000000000440000-0x000000000049B000-memory.dmp

Filesize
364KB

Download
memory/2496-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download