Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
07/11/2023, 20:33
General
-
Target
NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe
-
Size
82KB
-
MD5
02e51501d596ca7bf4cfb54adf3bb2b0
-
SHA1
5606453adf0b44b90d202d4783e409ed0c00f973
-
SHA256
83ad9dce557d04efee9ca4167843eb06bbc05fe2f7ac931722936697ba8c3269
-
SHA512
d027a2b12ceff7de4823e518690e15e61688e923573474c70ffb568ea9072e1b48eb5e9751fc3178b99c0634a2b47092c72420c5dd37338d47be7619d0d62c9a
-
SSDEEP
1536:seF83Lucdlc+LDo34yFXxukbH24zF/I9QbzEsLu8g00CmuJd4BXH:sJL1wpIyFXx5vmuXvLu8g0Bbd45
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exeC:\Users\Admin\AppData\Local\Temp\NEAS.02e51501d596ca7bf4cfb54adf3bb2b0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5668b89890211cb23fd38753e6fa306e9
SHA1b6a743cd5c90d2cab8d06df4babf462515163a5e
SHA2562cf1a30eb09789b8716d420c4b861321bd21dcf84ff80902a77a751421b9a04a
SHA512dafcc4fd00f6fde58e03d8108523ea97b615f9fa170e2c5a1b6f3e0abf182bfdd0a453c1cfb0f30530a3064233dbbbd4558defa258316874a6059a9df22457f6
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
232KB