71e75f65d305af9025ef839290ffc5af5d93a120fb10b847709309cc98dae66d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe
Size

122KB
MD5

de370a3ba6c8f4dd58d07913752c5c30
SHA1

a9114aa5c42d29e0cb9d406708a9034ec077cd3d
SHA256

71e75f65d305af9025ef839290ffc5af5d93a120fb10b847709309cc98dae66d
SHA512

afd518f58a78eda22971628ae515b61f3a03adb2370403220959dc4bd1f4d7ed90b4a02c44d4aafb2fad41c0b91b2af984dd87845b44661ead2211ca03450768
SSDEEP

3072:ik8Mb67uJPqdwv6hcwrzlZjBUFMR+tAAsvB:ik8MD1qde6F/lZFOZWB

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2176	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe

Executes dropped EXE 1 IoCs

pid	Process
2176	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe

Loads dropped DLL 1 IoCs

pid	Process
1384	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1384-0-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral1/files/0x0009000000012024-11.dat	upx
behavioral1/memory/1384-13-0x0000000000170000-0x00000000001ED000-memory.dmp	upx
behavioral1/files/0x0009000000012024-17.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1384	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1384	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe
2176	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2176	1384	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe	29
PID 1384 wrote to memory of 2176	1384	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe	29
PID 1384 wrote to memory of 2176	1384	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe	29
PID 1384 wrote to memory of 2176	1384	NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe

Filesize
122KB

MD5
e580828bb5d1f5c6088c681e0671ad61

SHA1
7c7fd543823b0c6e0d807151520ee592110ff80f

SHA256
92c6171b36f56b2f84ecbfbe17eff437eb01e3e96c735475faa678829319fad0

SHA512
c3fdd5c8016d280e0571e6d005755e79732d19d70b03814af66978722bb1614436ea1d3b065c0d4ae7a5856f9b4f151c632d516565e4609b3534360e5e408752

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.de370a3ba6c8f4dd58d07913752c5c30.exe

Filesize
122KB

MD5
e580828bb5d1f5c6088c681e0671ad61

SHA1
7c7fd543823b0c6e0d807151520ee592110ff80f

SHA256
92c6171b36f56b2f84ecbfbe17eff437eb01e3e96c735475faa678829319fad0

SHA512
c3fdd5c8016d280e0571e6d005755e79732d19d70b03814af66978722bb1614436ea1d3b065c0d4ae7a5856f9b4f151c632d516565e4609b3534360e5e408752

Download Submit
memory/1384-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1384-1-0x0000000000140000-0x000000000015F000-memory.dmp

Filesize
124KB

Download
memory/1384-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1384-13-0x0000000000170000-0x00000000001ED000-memory.dmp

Filesize
500KB

Download
memory/1384-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2176-18-0x0000000000140000-0x000000000015F000-memory.dmp

Filesize
124KB

Download
memory/2176-25-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2176-26-0x0000000000170000-0x000000000018E000-memory.dmp

Filesize
120KB

Download
memory/2176-31-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download