e4fe171bee305ddad87e068401122e004109eb87d6eee44d4402f5211699da92

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 23:33

Target

NEAS.667bfd1c075052b12bef430d6abc8920.exe
Size

199KB
MD5

667bfd1c075052b12bef430d6abc8920
SHA1

e6dde05da85c31c338468a0040d33fbe07d67817
SHA256

e4fe171bee305ddad87e068401122e004109eb87d6eee44d4402f5211699da92
SHA512

93ccf1f8b20e6a1f3e1b63148d69a036d089a614534e862164b16f372b51d47e9f31571b8bfb433504a15d257c6427d863a8519db2d32253eac0169e6fc6af21
SSDEEP

6144:6P+aqO4Kx5YOWHtsWVqgh8DyL0jRXnMseq2aVdU736uEOym5bc/pLOFgsvQzW:CeXg9Oj5dc2vIy

Score

7^/10

upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	NEAS.667bfd1c075052b12bef430d6abc8920.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	NEAS.667bfd1c075052b12bef430d6abc8920.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/memory/2200-10-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28
PID 2200 wrote to memory of 2792	2200	NEAS.667bfd1c075052b12bef430d6abc8920.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe
  2⤵
  PID:2792

memory/2200-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2200-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-7-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2792-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-11-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2792-13-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2792-14-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download