d9dc996506d136d5f4d6fb4d31cfdceb00c126630a6f98af92785b1fae3a4d64

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.bdcfb446f7aba2144d2172cf22815750.exe
Size

151KB
MD5

bdcfb446f7aba2144d2172cf22815750
SHA1

9116781ddff8bbd8dc97945371850999147884ec
SHA256

d9dc996506d136d5f4d6fb4d31cfdceb00c126630a6f98af92785b1fae3a4d64
SHA512

46faa3d9cd84b52ad235bb7a37390dd7b77514bd0026e4f378fa7c35b14b01b8974b670b6867679d99e638765e709d6eaf15fc513b5b6e1a7a751fe8fadc9480
SSDEEP

3072:oQzrhhx9yuk/4CrNuXsNTTBm5D5LMXqNv:o6fPyH7Nu8BT4lMXqB

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3060	axfniqh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\bqqaoam.dll	axfniqh.exe
File created	C:\PROGRA~3\Mozilla\axfniqh.exe	NEAS.bdcfb446f7aba2144d2172cf22815750.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.bdcfb446f7aba2144d2172cf22815750.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.bdcfb446f7aba2144d2172cf22815750.exe"
1⤵
- Drops file in Program Files directory
PID:4496

C:\PROGRA~3\Mozilla\axfniqh.exe
C:\PROGRA~3\Mozilla\axfniqh.exe -pdtylqd
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\axfniqh.exe

Filesize
151KB

MD5
fb5a5a78f6313f3eb06d2dfe62a5cd60

SHA1
960486ee86780c6de5721b076aa8e7f583f1e17b

SHA256
6eaf754e9d35e115ae057ce64818b393a25160178fef6c07fc4c6a4d9b7fbf41

SHA512
ea4436a8c100c9edacffd183ba80cbcb79420d66ed2b26220c943494d6150a6afdf3a6082710a82dc5540175ee34975576c5d4dde730a39d714bdad02ea1f64f

Download Submit
C:\ProgramData\Mozilla\axfniqh.exe

Filesize
151KB

MD5
fb5a5a78f6313f3eb06d2dfe62a5cd60

SHA1
960486ee86780c6de5721b076aa8e7f583f1e17b

SHA256
6eaf754e9d35e115ae057ce64818b393a25160178fef6c07fc4c6a4d9b7fbf41

SHA512
ea4436a8c100c9edacffd183ba80cbcb79420d66ed2b26220c943494d6150a6afdf3a6082710a82dc5540175ee34975576c5d4dde730a39d714bdad02ea1f64f

Download Submit
memory/3060-10-0x0000000000D10000-0x0000000000D6B000-memory.dmp

Filesize
364KB

Download
memory/3060-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4496-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4496-1-0x00000000021D0000-0x000000000222B000-memory.dmp

Filesize
364KB

Download
memory/4496-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download