f2866b86d795b9d6be5372690135a57fc6acbf2891dee29194cb0d73c0ec2bee

Analysis

max time kernel
155s
max time network
147s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe
Size

482KB
MD5

966ce1ad1b39041f8af5355c3d4f89e0
SHA1

8c220be3d7e37a2c546fd17b8f11ccc26d5a741e
SHA256

f2866b86d795b9d6be5372690135a57fc6acbf2891dee29194cb0d73c0ec2bee
SHA512

445803a15f49c02645d3862f04265778dca6df0285ab7a873e552cea76fcfc4736ca8bdda1e5015b092bfdfbe2a64061df758f6a87685f18a0fb9aa0b6c03718
SSDEEP

6144:2VTqrW9Q2dMtLrg4zhStfz1Sr8xgDsUh4zhStfz1NDsUh4zhSob:2V2rW9H+t3871Tot71No

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2764	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2148	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe
2148	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\b1aecb3c\jusched.exe	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe
File created	C:\Program Files (x86)\b1aecb3c\b1aecb3c	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2764	2148	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe	29
PID 2148 wrote to memory of 2764	2148	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe	29
PID 2148 wrote to memory of 2764	2148	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe	29
PID 2148 wrote to memory of 2764	2148	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\b1aecb3c\jusched.exe
  "C:\Program Files (x86)\b1aecb3c\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\b1aecb3c\jusched.exe

Filesize
482KB

MD5
4a2058793e2f26daf39bd591507aa445

SHA1
f1475df3851b5658d47b8d1cae13cba3b313fd01

SHA256
1f2582d8dacc03be5478fe561353d472349118822995e4edcb51e9ac8d09e084

SHA512
0970bba0dcde2e295de588cf39f0071e833fd951383c25e6c3adba14b6fc5e996cd6310939da206f25ee539c8352cc7c4a98cf81b1e5d51edac50d42b7634330

Download Submit
C:\Program Files (x86)\b1aecb3c\jusched.exe

Filesize
482KB

MD5
4a2058793e2f26daf39bd591507aa445

SHA1
f1475df3851b5658d47b8d1cae13cba3b313fd01

SHA256
1f2582d8dacc03be5478fe561353d472349118822995e4edcb51e9ac8d09e084

SHA512
0970bba0dcde2e295de588cf39f0071e833fd951383c25e6c3adba14b6fc5e996cd6310939da206f25ee539c8352cc7c4a98cf81b1e5d51edac50d42b7634330

Download Submit
\Program Files (x86)\b1aecb3c\jusched.exe

Filesize
482KB

MD5
4a2058793e2f26daf39bd591507aa445

SHA1
f1475df3851b5658d47b8d1cae13cba3b313fd01

SHA256
1f2582d8dacc03be5478fe561353d472349118822995e4edcb51e9ac8d09e084

SHA512
0970bba0dcde2e295de588cf39f0071e833fd951383c25e6c3adba14b6fc5e996cd6310939da206f25ee539c8352cc7c4a98cf81b1e5d51edac50d42b7634330

Download Submit
\Program Files (x86)\b1aecb3c\jusched.exe

Filesize
482KB

MD5
4a2058793e2f26daf39bd591507aa445

SHA1
f1475df3851b5658d47b8d1cae13cba3b313fd01

SHA256
1f2582d8dacc03be5478fe561353d472349118822995e4edcb51e9ac8d09e084

SHA512
0970bba0dcde2e295de588cf39f0071e833fd951383c25e6c3adba14b6fc5e996cd6310939da206f25ee539c8352cc7c4a98cf81b1e5d51edac50d42b7634330

Download Submit
memory/2148-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2148-4-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2148-13-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2148-12-0x00000000027B0000-0x000000000283A000-memory.dmp

Filesize
552KB

Download
memory/2764-15-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download