Analysis
-
max time kernel
174s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
11-11-2023 14:09
General
-
Target
NEAS.7c28d2a69e76f7be1d785c9fac270640.exe
-
Size
122KB
-
MD5
7c28d2a69e76f7be1d785c9fac270640
-
SHA1
e54fa8ccb5dd3df5d72b9aaf55b6cdd50e9937c0
-
SHA256
9155d5a642ac3def70e572dcc46e68daaa658879563b1f064ffd1d8ab5911d19
-
SHA512
5f6a924e36ad0a12e556a2f8d71d244d854b8e0f081c6e5772a79b45bae1d03e7e6242fd45b6d1b59cd44079c638badab0292a17d280ef851a7fa7525ac02a1d
-
SSDEEP
3072:hveNtheo29L6HBP69hMO31Jui8l2CRuQFykCoZbbZTepf:ChOGHBP69hZlJuRlVnFyFoNZTk
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7c28d2a69e76f7be1d785c9fac270640.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.7c28d2a69e76f7be1d785c9fac270640.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7c28d2a69e76f7be1d785c9fac270640.exeC:\Users\Admin\AppData\Local\Temp\NEAS.7c28d2a69e76f7be1d785c9fac270640.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD5acf33a3b6617eb9e3bc0213aebb12a9d
SHA1e7e643ee2f5c2483b5384770a254fac790fec460
SHA25696221d881a8454c664dd096f570dc0525a3363136648d10bb311e58b9ee11229
SHA51224f5aecef76b92c5d1de883a4f09787974f30fc27922384743d11d4068a3228c0b1a34b9c49252acbbec67fe1a60552ed7016d2094d34f733ee65f5fe03ed5ed
-
Filesize
500KB
-
Filesize
124KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
500KB
-
Filesize
120KB
-
Filesize
56KB
-
Filesize
124KB
-
Filesize
500KB