Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2023, 17:26

General

  • Target

    NEAS.4d9a7ecb62498848ede283d5824386d0.exe

  • Size

    459KB

  • MD5

    4d9a7ecb62498848ede283d5824386d0

  • SHA1

    79bae4fdcf6a81f728f8c87257cc267f5e11f451

  • SHA256

    83774db723e6f86c40cab8b24a0ab190b6a9a66944fd228d2f506ce322823d71

  • SHA512

    dc7ddd06187e33670fc7608ea10f01314744759ebd87691694c27af4a4191f55ef440d01510dbc60298877dd970a5359273ee5820faf5e23d267177768fd67b0

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.4d9a7ecb62498848ede283d5824386d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d9a7ecb62498848ede283d5824386d0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\$$$$$.bat
      2⤵
      • Deletes itself
      PID:1968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$$$$$.bat

    Filesize

    210B

    MD5

    dc9d5efa6945f7ee9eb44a81692bf02b

    SHA1

    8c4aa7abc833dbc860b74c508ea61ea32376dfe5

    SHA256

    bee992943daf59ce0d3d1e53e3fea227ba58391b2ad4ea2df0935de3ef5f3c69

    SHA512

    9592f97f3c12d7c693eec870674223ca08fa05029f9f23bfd8d3317956042792a0a6a28b109c188daec2995c827ea9c3fc43a8c45a87fe710150d4d793cb7fa6

  • C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

    Filesize

    459KB

    MD5

    4d9a7ecb62498848ede283d5824386d0

    SHA1

    79bae4fdcf6a81f728f8c87257cc267f5e11f451

    SHA256

    83774db723e6f86c40cab8b24a0ab190b6a9a66944fd228d2f506ce322823d71

    SHA512

    dc7ddd06187e33670fc7608ea10f01314744759ebd87691694c27af4a4191f55ef440d01510dbc60298877dd970a5359273ee5820faf5e23d267177768fd67b0

  • \??\c:\$$$$$.bat

    Filesize

    210B

    MD5

    dc9d5efa6945f7ee9eb44a81692bf02b

    SHA1

    8c4aa7abc833dbc860b74c508ea61ea32376dfe5

    SHA256

    bee992943daf59ce0d3d1e53e3fea227ba58391b2ad4ea2df0935de3ef5f3c69

    SHA512

    9592f97f3c12d7c693eec870674223ca08fa05029f9f23bfd8d3317956042792a0a6a28b109c188daec2995c827ea9c3fc43a8c45a87fe710150d4d793cb7fa6

  • memory/2396-0-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2396-687-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2396-826-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB