29740d4105c254541a4abc8d4b60786cf0b6383f5fd314e1bd355ce0a7a0b4f1

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe
Size

132KB
MD5

8e7e9d1c9326f41fee568ee4116fea40
SHA1

aaea7f6941ce7f38c0786fb09b4c81c0a83148e3
SHA256

29740d4105c254541a4abc8d4b60786cf0b6383f5fd314e1bd355ce0a7a0b4f1
SHA512

4a99cebbbe3b0f3a0bb49f532ab2e65b8ca34183d04bff783fe9fd2e8a73c095bf586ea0ba1dd67be731f910cb83a4967700dfc416c72d7853d2fe83de1fb146
SSDEEP

3072:5FgJNhlzUMdc6+adSAs7uxzjaT36bvkTda6vWyQ7BCdhk:5FgrzUM66+adOOa7GuW77Ghk

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3948	asqmzyj.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\asqmzyj.exe	NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe
File created	C:\PROGRA~3\Mozilla\mzqcwxd.dll	asqmzyj.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe"
1⤵
- Drops file in Program Files directory
PID:2072

C:\PROGRA~3\Mozilla\asqmzyj.exe
C:\PROGRA~3\Mozilla\asqmzyj.exe -kewnvcd
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\asqmzyj.exe

Filesize
132KB

MD5
e59156defd65da6d46c938271410b30f

SHA1
ef029017c2b0a8039f4f5a6974bbdd6fb9c0f879

SHA256
26f2c3f312f08656814312face6aae00a517c50e224762535134d08d73571fe8

SHA512
e05d5f40bc816709632c2e239d3e977bccf0dd75686dc3c19a687e1f37ac2f480a8dfb911693ab3adf5f29f96f182891c3cd080d0022483819bd4a8cccdfe910

Download Submit
C:\ProgramData\Mozilla\asqmzyj.exe

Filesize
132KB

MD5
e59156defd65da6d46c938271410b30f

SHA1
ef029017c2b0a8039f4f5a6974bbdd6fb9c0f879

SHA256
26f2c3f312f08656814312face6aae00a517c50e224762535134d08d73571fe8

SHA512
e05d5f40bc816709632c2e239d3e977bccf0dd75686dc3c19a687e1f37ac2f480a8dfb911693ab3adf5f29f96f182891c3cd080d0022483819bd4a8cccdfe910

Download Submit
memory/2072-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2072-1-0x0000000002600000-0x000000000265B000-memory.dmp

Filesize
364KB

Download
memory/2072-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3948-9-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3948-11-0x00000000007D0000-0x000000000082B000-memory.dmp

Filesize
364KB

Download
memory/3948-17-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download