Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
06/11/2023, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.9c5764580f69d346803e96bdaa768c40.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.9c5764580f69d346803e96bdaa768c40.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.9c5764580f69d346803e96bdaa768c40.exe
-
Size
31KB
-
MD5
9c5764580f69d346803e96bdaa768c40
-
SHA1
300ab43c5269562b60adf73b00c1f80e0a9b6fcc
-
SHA256
6697b0aefaf8902f2449f66a7bcee61eba3108a73dfc1f58fe4e2f96bd6c8b4e
-
SHA512
7ad53a28b0a371c4f419d131a7b503c8eac774b54f9f56d3ba12bcc0162817a5c5d449927e240fdcbfafbbb0f1d13cd6bea4e663260164c70a6a1624da28d3a0
-
SSDEEP
384:ODvbC3yTGQsSDYHdTfoBiml+WX2n65+h7iQroC9CE5cXDQ3XdF4OrcaiBX/6:OgQsqgf3ml06sh7iQroCHWKYOghX/6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2292 pnit.exe -
Loads dropped DLL 1 IoCs
pid Process 3068 NEAS.9c5764580f69d346803e96bdaa768c40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2292 3068 NEAS.9c5764580f69d346803e96bdaa768c40.exe 28 PID 3068 wrote to memory of 2292 3068 NEAS.9c5764580f69d346803e96bdaa768c40.exe 28 PID 3068 wrote to memory of 2292 3068 NEAS.9c5764580f69d346803e96bdaa768c40.exe 28 PID 3068 wrote to memory of 2292 3068 NEAS.9c5764580f69d346803e96bdaa768c40.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9c5764580f69d346803e96bdaa768c40.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9c5764580f69d346803e96bdaa768c40.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\pnit.exe"C:\Users\Admin\AppData\Local\Temp\pnit.exe"2⤵
- Executes dropped EXE
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD55bcd9c036e868e70fb939e8af6a37b10
SHA119273dbe9ef33519b88fe760113a8efe7ba6530b
SHA256139b187fffad5bfe55f3a733636057843aa04745ac1ae2272329b19788c11c57
SHA512901a1eadf483aad9e1fcb7aea1038c7f4bcbb745d39bec236ae62a8fdeb978732d9bc2cbc7c44d10ff5d372fc558fd3c37c435f2f420f856a1d8552b1eef4f95
-
Filesize
31KB
MD55bcd9c036e868e70fb939e8af6a37b10
SHA119273dbe9ef33519b88fe760113a8efe7ba6530b
SHA256139b187fffad5bfe55f3a733636057843aa04745ac1ae2272329b19788c11c57
SHA512901a1eadf483aad9e1fcb7aea1038c7f4bcbb745d39bec236ae62a8fdeb978732d9bc2cbc7c44d10ff5d372fc558fd3c37c435f2f420f856a1d8552b1eef4f95
-
Filesize
31KB
MD55bcd9c036e868e70fb939e8af6a37b10
SHA119273dbe9ef33519b88fe760113a8efe7ba6530b
SHA256139b187fffad5bfe55f3a733636057843aa04745ac1ae2272329b19788c11c57
SHA512901a1eadf483aad9e1fcb7aea1038c7f4bcbb745d39bec236ae62a8fdeb978732d9bc2cbc7c44d10ff5d372fc558fd3c37c435f2f420f856a1d8552b1eef4f95