Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 16:43

General

  • Target

    NEAS.e539a2ea4b0e44b7713eb0a83bc12390.exe

  • Size

    29KB

  • MD5

    e539a2ea4b0e44b7713eb0a83bc12390

  • SHA1

    f70b0c506f4c1a59aa8d0ddb19a621961cc6fc52

  • SHA256

    534bb8c9f466e0e570fa1d18f3f6996aed09052ee0661c8cd9669234049a7e2d

  • SHA512

    2c2228ec7b98e43372dbe07ef8be0a698a86e885e3584e2e8581d98fa16fc143ad1302aed5a9570b9d46ee41982f4ca10dd5e7472f3523e71a7f2ccbf2cbca8b

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Pp:AEwVs+0jNDY1qi/qJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.e539a2ea4b0e44b7713eb0a83bc12390.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.e539a2ea4b0e44b7713eb0a83bc12390.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2JBMCFQZ\default[9].htm

    Filesize

    315B

    MD5

    14b82aec966e8e370a28053db081f4e9

    SHA1

    a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

    SHA256

    202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

    SHA512

    ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5T0U3BIO\defaultORXBGUPO.htm

    Filesize

    312B

    MD5

    c15952329e9cd008b41f979b6c76b9a2

    SHA1

    53c58cc742b5a0273df8d01ba2779a979c1ff967

    SHA256

    5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

    SHA512

    6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5T0U3BIO\default[1].htm

    Filesize

    305B

    MD5

    2c4ce699b73ce3278646321d836aca40

    SHA1

    72ead77fbd91cfadae8914cbb4c023a618bf0bd1

    SHA256

    e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

    SHA512

    89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5T0U3BIO\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MKS56Y3I\default[1].htm

    Filesize

    304B

    MD5

    605de1f61d0446f81e63c25750e99301

    SHA1

    0eaf9121f9dc1338807a511f92ea0b30dc2982a5

    SHA256

    049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

    SHA512

    a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MKS56Y3I\default[2].htm

    Filesize

    304B

    MD5

    3483bf8f41c9a3b9c4acd2c9be5d8d00

    SHA1

    fe960cf9b9744217b295ed86f66e80c58c4d6052

    SHA256

    9b402b64c9cddf2ce4c139df23fd6354b51bb218706076d0b6ed1c128df25535

    SHA512

    1df7f496dcd70238c3982e595964b552548a7100f3b238a65476cc57fb10e3e1d82c19ffc3f4d61ead29657623665126f3e09561bc0feb39f3aa189f603757db

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MKS56Y3I\default[3].htm

    Filesize

    302B

    MD5

    485828cfdc2c1efc0c51ff9b74dd34f8

    SHA1

    6f685134b031e9b2fff0eb8c7212c99bfba3719f

    SHA256

    615a15f6247f8f979b3a066801c98489018b1d137fd5d9b7bce73824acc70f06

    SHA512

    69736b9700c2f47feab282d8bf8bd6f02c9f62ecb9c02466b6cf76b1cd4b1becc70803123e73427c871c2aeb2eb64540edf95a342f78d9211ac0571e8fd1f426

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MKS56Y3I\default[4].htm

    Filesize

    303B

    MD5

    6a62ed00d5950a7aa3df6d446d0beb92

    SHA1

    608da2a7b63e92b731a7beb2d990405d7a6e9611

    SHA256

    7aaaf31ea9c2999c775008a4b769336c91d87dc8f6dc0a1015bb45c61bc39fdb

    SHA512

    10a77d30bd2a5a930233e79830ac6e0a695bcfacb4e33fe9a67a7dc4b4c0ffaf3ca6ce458bf2a6714b9c590997ff816f207bee87536516a2c8e711c3c161773d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PR01V9ZG\defaultHI161OFS.htm

    Filesize

    305B

    MD5

    157431349a057954f4227efc1383ecad

    SHA1

    69ccc939e6b36aa1fabb96ad999540a5ab118c48

    SHA256

    8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

    SHA512

    6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PR01V9ZG\default[2].htm

    Filesize

    304B

    MD5

    4d1a10f22e8332513741877c47ac8970

    SHA1

    f68ecc13b7a71e948c6d137be985138586deb726

    SHA256

    a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

    SHA512

    4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PR01V9ZG\default[5].htm

    Filesize

    303B

    MD5

    0a53779b07f9c9c56ef169499851915e

    SHA1

    281bf81610dae812be159f95a0858f88f9b96637

    SHA256

    b946117d346ecf850135aae1ac65b368f4effd806bf5180ecd3c585f1324dbd1

    SHA512

    5a5016dcdeef68be7115eafee0a6844e3cc868fa04f353980d924fca7394962d919d8dece40b15b7ddcc867f956fc8c0e522b68688ca409f1671c39e42973dc6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PR01V9ZG\default[6].htm

    Filesize

    308B

    MD5

    5243568476eb2052b2f3b67dc9053e86

    SHA1

    b126aa6506772f9024b76580bdf28b45e3a7f051

    SHA256

    2d458622dc76eb87e44cc7db89309efdf50f99821145ae86864fd1b714cbaa80

    SHA512

    3c68cef4e3daa4bca6e8b3aa5a31874be1e4dec38fe9781c6fe4890980744527d0c6818eeb519f8e6b322118e1f08302d85972fa7da4ba8be9421aabf9a77833

  • C:\Users\Admin\AppData\Local\Temp\dvusw0miTg.log

    Filesize

    256B

    MD5

    7a545fa1baf8d34dcd4a3fb8b449c846

    SHA1

    ad570a610e06a78f25bf6ddedb94e17b44155fa0

    SHA256

    4b5f795b5d90e603b314574c75ffdb3e1a1aa7b373c3072d074b52a6a2644542

    SHA512

    1f409075a8a798764e21effaf6e629296111dc443235b07741e6cfdb06a9300bdf7480e2cc82b3b7eeedb128445b2b2f3dfcfe9b6a76a849ee4c8d7a8717e781

  • C:\Users\Admin\AppData\Local\Temp\tmpF29A.tmp

    Filesize

    29KB

    MD5

    cf0472c46c1ba88b0115e82bce14f691

    SHA1

    b31990b50509bd209965e9ad3ea0ed8b7f9087c5

    SHA256

    98ef5a831fbbfd78680b465cbe89971d1a1d973fc95a6b6eae275106d1155cdf

    SHA512

    04909bc6c77c4c19046f2decc7bde7dd9a0f6466c55f287c98291305a7f4e7551889e1f0d094a2c6e06282d45eec27466d45275aeed8ae3c2018e8392919113d

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    369ebc41f84ce5789a8ccc2d72ddef19

    SHA1

    15c7ced51082984399bc3337d7f5f7dabac851ba

    SHA256

    8ec51f637a1da6da0e3eeee37fc4e6d4549ee661c160652d78f2fe898ad71844

    SHA512

    34dd36cb2ac6084672d392e6e8f66ad3a944f15e04e3a87cc7a5043ef1235d8e364ca2c26e9d3c561d875455639279530a62fc9530b62fd21052d5eabd44e4a5

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    68041a32b86645b5575ed9b0ee23c46e

    SHA1

    fee463875d2aae9d85ba5b4182643a5ba6a13f44

    SHA256

    7990a125b68c611c611abe4d1961997be5905e4375baa066f56e022cbe186f00

    SHA512

    6297f16655cc039c0fdbd9f1a72f629afe815811d5269363cd20a63cde210ea9216bceac225f120437b1dd81729223766b7a44c2a2fb61fada8d543a84ab7fc9

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    679069f9fd9a4af23bfaa026926eb5b6

    SHA1

    833721ea3b85488e395e8934b4faf718abbe794d

    SHA256

    cf0e726c60a9a22279099bb65b49bed6129971fa262b0a7fee50e0719c502025

    SHA512

    b899058cee1ccafc2004ce1e33d7c9a13cab63cb05ecca38d6a49ccbcf8ca5567ae704e69e5f683ab90ff7d0355bcff282b8baed3106bc9b98b4080f2a8d4893

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1420-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-145-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-470-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-99-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-201-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-409-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-365-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-237-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-14-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-284-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-324-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1420-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4060-236-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-364-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-323-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-283-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-407-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-97-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-458-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-200-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4060-143-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB