4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
Size

1.4MB
MD5

a6c81a90d72b2ca218b6a74996f62e46
SHA1

6ee3282f253d4c117b87c27519505e4b238079f4
SHA256

4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4
SHA512

411cfa2b0e13b844da6d0741e2bb8a27b854ff884b72b9cb493dfd3d1223bf1472e5b27a4441c182a9894751f03222e78f09d520beb1767160a56a8be603fadc
SSDEEP

24576:US9nR7hC+aARWXVa5RZLVUIICx0TcoXicHVf+ppJ7W:VkiiCxjoBHVf+pT7W

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2780	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	28
PID 2068 wrote to memory of 2780	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	28
PID 2068 wrote to memory of 2780	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	28
PID 2068 wrote to memory of 2760	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	29
PID 2068 wrote to memory of 2760	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	29
PID 2068 wrote to memory of 2760	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	29
PID 2068 wrote to memory of 2792	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	30
PID 2068 wrote to memory of 2792	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	30
PID 2068 wrote to memory of 2792	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	30
PID 2068 wrote to memory of 2796	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	31
PID 2068 wrote to memory of 2796	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	31
PID 2068 wrote to memory of 2796	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	31
PID 2068 wrote to memory of 2640	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	32
PID 2068 wrote to memory of 2640	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	32
PID 2068 wrote to memory of 2640	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	32
PID 2068 wrote to memory of 2612	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	33
PID 2068 wrote to memory of 2612	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	33
PID 2068 wrote to memory of 2612	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	33
PID 2068 wrote to memory of 2872	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	34
PID 2068 wrote to memory of 2872	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	34
PID 2068 wrote to memory of 2872	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	34
PID 2068 wrote to memory of 2728	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	35
PID 2068 wrote to memory of 2728	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	35
PID 2068 wrote to memory of 2728	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	35
PID 2068 wrote to memory of 2664	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	36
PID 2068 wrote to memory of 2664	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	36
PID 2068 wrote to memory of 2664	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	36
PID 2068 wrote to memory of 2620	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	37
PID 2068 wrote to memory of 2620	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	37
PID 2068 wrote to memory of 2620	2068	NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe	37

C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4fe6f4391fa535d402b0bd20632c1967dbec2b2e77848782b22c320a22f7b1f4.exe
  2⤵
  PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x0000000000A70000-0x0000000000BD2000-memory.dmp

Filesize
1.4MB

Download
memory/2068-1-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/2068-2-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2068-3-0x00000000028E0000-0x00000000029C0000-memory.dmp

Filesize
896KB

Download
memory/2068-4-0x000000001B8B0000-0x000000001B990000-memory.dmp

Filesize
896KB

Download
memory/2068-5-0x000000001BDE0000-0x000000001BEA8000-memory.dmp

Filesize
800KB

Download
memory/2068-6-0x000000001C340000-0x000000001C408000-memory.dmp

Filesize
800KB

Download
memory/2068-7-0x0000000000740000-0x000000000078C000-memory.dmp

Filesize
304KB

Download
memory/2068-8-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download