Analysis

  • max time kernel
    7s
  • max time network
    12s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2023, 23:53

General

  • Target

    NEAS.5a4bb23f3e92bba8057c828c896d8660.exe

  • Size

    126KB

  • MD5

    5a4bb23f3e92bba8057c828c896d8660

  • SHA1

    6250b9e1d90cfb7a342341469e77de739113a8e4

  • SHA256

    8c90d5aab60e63a5cbb791226140536da21b5c95035d2f7dbbb892e598618dbd

  • SHA512

    470fea8cab8aee12d50f1fa691d92f46945b0db53e6a9a57d8ff21869f993b1082279094bed75f26611092b0aec238d5298eac6bc0af46afa2ebbceac16d5bef

  • SSDEEP

    1536:JBBHjvgESHlHPUoQWJAn7W+izHlcj4p5LxOzAfGFmGI5zN+MmJz5lbQpRKYS9Pix:/BHjoESlHPAnC55cQDkjmGtlD2Y5j5g

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.5a4bb23f3e92bba8057c828c896d8660.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5a4bb23f3e92bba8057c828c896d8660.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4092
  • C:\PROGRA~3\Mozilla\gpypjxc.exe
    C:\PROGRA~3\Mozilla\gpypjxc.exe -tripsff
    1⤵
    • Executes dropped EXE
    PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\gpypjxc.exe

    Filesize

    126KB

    MD5

    86d37e872b5693b3a7a0d5f9491fe36b

    SHA1

    fbf5656136508c455f972d7ff22554b819c07b54

    SHA256

    697fa14efea2bf8189441b4a9875c5462f121943506b20f91136abbb82c40af2

    SHA512

    6cd5258c4cf9f26e882732de5b9d1480e94acdf30acb1996755a37b4ef627d3123d13647ccd88015e5585412e06d9b2d8f8cc395c1bd0ee446f3422664c27cf9

  • C:\ProgramData\Mozilla\gpypjxc.exe

    Filesize

    126KB

    MD5

    86d37e872b5693b3a7a0d5f9491fe36b

    SHA1

    fbf5656136508c455f972d7ff22554b819c07b54

    SHA256

    697fa14efea2bf8189441b4a9875c5462f121943506b20f91136abbb82c40af2

    SHA512

    6cd5258c4cf9f26e882732de5b9d1480e94acdf30acb1996755a37b4ef627d3123d13647ccd88015e5585412e06d9b2d8f8cc395c1bd0ee446f3422664c27cf9

  • memory/4092-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/4092-1-0x0000000000720000-0x000000000077B000-memory.dmp

    Filesize

    364KB

  • memory/4092-9-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB