Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07-11-2023 15:04
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.10fa976229429956070b1c3f04e245e1.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.10fa976229429956070b1c3f04e245e1.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.10fa976229429956070b1c3f04e245e1.exe
-
Size
6.9MB
-
MD5
10fa976229429956070b1c3f04e245e1
-
SHA1
6210538cbbd9c9638541ee9afc04e82f6f23017e
-
SHA256
694e96dc16114b2413c442ef8ec159f3a03e2e2f609785e63054c3b5e2758b4d
-
SHA512
ec947abb4cdf58390ad41eb47d2e066394d6e4a654f8b2c3c3df0c6c93033b5d1f8b770506311b1768d7fdcb8824e520d49ca9c0b1b7eb7b91a5d5a36f2f4e07
-
SSDEEP
196608:bf7HTjPBz4KkAYcDz7yhGbbRZvZUE0F6lagttgw:/Hv6yprvRZeGPj
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" NEAS.10fa976229429956070b1c3f04e245e1.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\apt.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX905E.tmp NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\ConfirmUnlock.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\sIRC4.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX909F.tmp NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\mip.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX8FB2.tmp NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX907F.tmp NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javap.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe NEAS.10fa976229429956070b1c3f04e245e1.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe NEAS.10fa976229429956070b1c3f04e245e1.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD504dbbe450ad747b8a5e256773d0c661b
SHA18da56be117f49223a59467b859e50d2ae1fbb213
SHA256561ff47341bf1612b23ee1c47589881fb8769aea1c8825982947df61b84b87d9
SHA51260956123afc11ed559e3bb9c35fcf8b9612b0042eda45d393738c820d9fd0192feaeb94466e2608afd5283a5651cb6cea52e1bac0219b6dc3136bd30a6a49d96
-
Filesize
6.9MB
MD510fa976229429956070b1c3f04e245e1
SHA16210538cbbd9c9638541ee9afc04e82f6f23017e
SHA256694e96dc16114b2413c442ef8ec159f3a03e2e2f609785e63054c3b5e2758b4d
SHA512ec947abb4cdf58390ad41eb47d2e066394d6e4a654f8b2c3c3df0c6c93033b5d1f8b770506311b1768d7fdcb8824e520d49ca9c0b1b7eb7b91a5d5a36f2f4e07