29740d4105c254541a4abc8d4b60786cf0b6383f5fd314e1bd355ce0a7a0b4f1

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe
Size

132KB
MD5

8e7e9d1c9326f41fee568ee4116fea40
SHA1

aaea7f6941ce7f38c0786fb09b4c81c0a83148e3
SHA256

29740d4105c254541a4abc8d4b60786cf0b6383f5fd314e1bd355ce0a7a0b4f1
SHA512

4a99cebbbe3b0f3a0bb49f532ab2e65b8ca34183d04bff783fe9fd2e8a73c095bf586ea0ba1dd67be731f910cb83a4967700dfc416c72d7853d2fe83de1fb146
SSDEEP

3072:5FgJNhlzUMdc6+adSAs7uxzjaT36bvkTda6vWyQ7BCdhk:5FgrzUM66+adOOa7GuW77Ghk

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2320	dhuqaed.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\dhuqaed.exe	NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe
File created	C:\PROGRA~3\Mozilla\fjgblbm.dll	dhuqaed.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2320	2284	taskeng.exe	29
PID 2284 wrote to memory of 2320	2284	taskeng.exe	29
PID 2284 wrote to memory of 2320	2284	taskeng.exe	29
PID 2284 wrote to memory of 2320	2284	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe"
1⤵
- Drops file in Program Files directory
PID:2184

C:\Windows\system32\taskeng.exe
taskeng.exe {6ACE7FCC-0DB1-4CE1-BDA7-995214C4C697} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\PROGRA~3\Mozilla\dhuqaed.exe
  C:\PROGRA~3\Mozilla\dhuqaed.exe -vpwggce
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\dhuqaed.exe

Filesize
132KB

MD5
e5d37e9885d6ef19a7deae8f291bbdfd

SHA1
4ddddbc1822df24f627a23996a8d5c24c9854eb4

SHA256
791187db92606e5befe197d5c1293fe98a036da8244b5ec199f8570396bf92e1

SHA512
4c87e20e911378ccd02b238a4d7a7115fa88e3450534df6da99bf6d0e21d0ae6b443b74a98fd14cd94129d827ea50db5f6cc8228236cbed734475e923766c0cb

Download Submit
C:\PROGRA~3\Mozilla\dhuqaed.exe

Filesize
132KB

MD5
e5d37e9885d6ef19a7deae8f291bbdfd

SHA1
4ddddbc1822df24f627a23996a8d5c24c9854eb4

SHA256
791187db92606e5befe197d5c1293fe98a036da8244b5ec199f8570396bf92e1

SHA512
4c87e20e911378ccd02b238a4d7a7115fa88e3450534df6da99bf6d0e21d0ae6b443b74a98fd14cd94129d827ea50db5f6cc8228236cbed734475e923766c0cb

Download Submit
memory/2184-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2184-1-0x0000000000430000-0x000000000048B000-memory.dmp

Filesize
364KB

Download
memory/2184-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2320-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download