Analysis

  • max time kernel
    30s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2023, 11:53

General

  • Target

    NEAS.5def1dfc96cf89abda6747f3f24fdec0.exe

  • Size

    181KB

  • MD5

    5def1dfc96cf89abda6747f3f24fdec0

  • SHA1

    9adc82885fb973641580d24dd3f0fd95d1486d8a

  • SHA256

    b43522bb6e35052123378ebf6cfe017c0dace4430c71cad89b6d90e7cde5f4c8

  • SHA512

    1983be05987cdb16fefd73cee7dcd9e18d2791950e14c74d9de5a3c0debc7ad182c2e7330f69327339260843892275df2cd32b823b120333ec39e6a0a5158879

  • SSDEEP

    3072:YG9WdoX/14GwN+iHhK/xYHeAvG4HTQSKsTRbjpu5kS6AF+mheuxRO0Vrs:D9WG14GWx2xYnIstbjgHESeuz5s

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.5def1dfc96cf89abda6747f3f24fdec0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5def1dfc96cf89abda6747f3f24fdec0.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1656
  • C:\PROGRA~3\Mozilla\yqzqgud.exe
    C:\PROGRA~3\Mozilla\yqzqgud.exe -ikphvdj
    1⤵
    • Executes dropped EXE
    PID:696

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~3\Mozilla\yqzqgud.exe

          Filesize

          129KB

          MD5

          e4bfdf6cd550624b835eeb94a680949c

          SHA1

          763753a8d8a9237e50b6d4803cbedaf9b993b11c

          SHA256

          b62c9b9424a1388064cb452ef6d3af7f17a6bcf5e7bfa3b86478e0a0eabde594

          SHA512

          db7cd3199e1a79a0210463b7387f3deef8497b8cec88a051dccd4b9e04a8a9f5a02b3d2f030deccf10316e151b2f2789e1b5f0b5c8aeb2e109fd42b56f180561

        • C:\ProgramData\Mozilla\yqzqgud.exe

          Filesize

          181KB

          MD5

          42b3e96f650236c13b1fc8586df38387

          SHA1

          417f1e55da28df224cd1685948be409cdddb931f

          SHA256

          1a45d80a09d342dd42bd45b3f9d83739ee68691832cb76181a5489e5a053bc73

          SHA512

          a16eabad6dd19624a7b59ea0fcffcd2f5dea5a841bd820b79da6a0a542ee27c65093164b2db3d7bf9a6d4bc19a44cb53bcc723a4820ac8793cea9eb3817aee0a

        • memory/1656-0-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/1656-1-0x00000000021A0000-0x00000000021FB000-memory.dmp

          Filesize

          364KB

        • memory/1656-7-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB