83ad9dce557d04efee9ca4167843eb06bbc05fe2f7ac931722936697ba8c3269

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe
Size

82KB
MD5

02e51501d596ca7bf4cfb54adf3bb2b0
SHA1

5606453adf0b44b90d202d4783e409ed0c00f973
SHA256

83ad9dce557d04efee9ca4167843eb06bbc05fe2f7ac931722936697ba8c3269
SHA512

d027a2b12ceff7de4823e518690e15e61688e923573474c70ffb568ea9072e1b48eb5e9751fc3178b99c0634a2b47092c72420c5dd37338d47be7619d0d62c9a
SSDEEP

1536:seF83Lucdlc+LDo34yFXxukbH24zF/I9QbzEsLu8g00CmuJd4BXH:sJL1wpIyFXx5vmuXvLu8g0Bbd45

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1552	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe

Executes dropped EXE 1 IoCs

pid	Process
1552	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe

Loads dropped DLL 1 IoCs

pid	Process
2564	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2564-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x000e000000012019-10.dat	upx
behavioral1/memory/2564-12-0x0000000000300000-0x000000000033A000-memory.dmp	upx
behavioral1/memory/1552-17-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x000e000000012019-15.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2564	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2564	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe
1552	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1552	2564	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe	29
PID 2564 wrote to memory of 1552	2564	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe	29
PID 2564 wrote to memory of 1552	2564	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe	29
PID 2564 wrote to memory of 1552	2564	NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe

Filesize
82KB

MD5
3a9f43d01f75e9499007520bbe7df68d

SHA1
7e23a279d822ca5319f46ec7c19d4519f1f2bdec

SHA256
00e5cd024288bc130b51f1fc6dd6f93a56d46bab45529a3d0b8b30e85a9405ce

SHA512
293f49fcf015d6b489172c0d11e1a654b98da5edce27616c4a409530d0ffd2c78c4f88be3b9475d7751abeccbd81d128a6e93c24770f5888c0aa299d7e750407

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe

Filesize
82KB

MD5
3a9f43d01f75e9499007520bbe7df68d

SHA1
7e23a279d822ca5319f46ec7c19d4519f1f2bdec

SHA256
00e5cd024288bc130b51f1fc6dd6f93a56d46bab45529a3d0b8b30e85a9405ce

SHA512
293f49fcf015d6b489172c0d11e1a654b98da5edce27616c4a409530d0ffd2c78c4f88be3b9475d7751abeccbd81d128a6e93c24770f5888c0aa299d7e750407

Download Submit
memory/1552-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1552-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1552-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1552-29-0x00000000002F0000-0x000000000030B000-memory.dmp

Filesize
108KB

Download
memory/1552-19-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/1552-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2564-1-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2564-12-0x0000000000300000-0x000000000033A000-memory.dmp

Filesize
232KB

Download
memory/2564-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2564-16-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2564-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download