4d5f86eb3402626d8e0332a59fca3806b151ebc8c9abb8f23c55eabb349a190b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe
Size

86KB
MD5

84cf95bd71bde565c0b3b82f14c86800
SHA1

dd2f36dfcd1ed45f05e8dda5a205b37c6738b0ea
SHA256

4d5f86eb3402626d8e0332a59fca3806b151ebc8c9abb8f23c55eabb349a190b
SHA512

aada54958e273be65c2a7274ea11adb13538a798f81e2b116c9467f6593673307f40f9b39ae8b38acd03d2f8a964ee0a70bc7fd70e2736bc6193764154df2b37
SSDEEP

1536:7yN9gpQ6t/TW316yBXjeZXVQvowTVu4UOphNzl4jWDe4/uPs+XVjL7gxvE5CJ5y7:7PwvBTMVKLF9Saa4GPs+FjL7evEQJ5y7

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2660	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Loads dropped DLL 1 IoCs

pid	Process
2800	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2800	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2800	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe
2660	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2660	2800	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe	21
PID 2800 wrote to memory of 2660	2800	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe	21
PID 2800 wrote to memory of 2660	2800	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe	21
PID 2800 wrote to memory of 2660	2800	NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe	21

C:\Users\Admin\AppData\Local\Temp\NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Filesize
59KB

MD5
105a32f713dc117e0b03450b723df266

SHA1
3dd90d1e876631a8bb75ccef55ddb4d6198841a7

SHA256
a95f53e10b132ea90449cf0aff34c6babd9eb7fc43375e1d1314d2a28d3e39a2

SHA512
93f5b31bd367e0ee8083e543ee0af9685af267fe7b5d8e45be1620240e0e92d1be23821a0f39774c85b52077e9ace34db7b5758622ee65dc511838e704938084

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Filesize
59KB

MD5
105a32f713dc117e0b03450b723df266

SHA1
3dd90d1e876631a8bb75ccef55ddb4d6198841a7

SHA256
a95f53e10b132ea90449cf0aff34c6babd9eb7fc43375e1d1314d2a28d3e39a2

SHA512
93f5b31bd367e0ee8083e543ee0af9685af267fe7b5d8e45be1620240e0e92d1be23821a0f39774c85b52077e9ace34db7b5758622ee65dc511838e704938084

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.84cf95bd71bde565c0b3b82f14c86800_JC.exe

Filesize
59KB

MD5
105a32f713dc117e0b03450b723df266

SHA1
3dd90d1e876631a8bb75ccef55ddb4d6198841a7

SHA256
a95f53e10b132ea90449cf0aff34c6babd9eb7fc43375e1d1314d2a28d3e39a2

SHA512
93f5b31bd367e0ee8083e543ee0af9685af267fe7b5d8e45be1620240e0e92d1be23821a0f39774c85b52077e9ace34db7b5758622ee65dc511838e704938084

Download Submit
memory/2660-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2660-17-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2660-24-0x00000000002F0000-0x000000000030D000-memory.dmp

Filesize
116KB

Download
memory/2660-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2660-29-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2800-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2800-1-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2800-12-0x0000000000160000-0x000000000019D000-memory.dmp

Filesize
244KB

Download
memory/2800-15-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2800-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download