bb2b54e9689794cfd40fe2126102203ccb00ee5d3aae22e5f3b6db95cb18f1b9

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.458b335b1d6a0fcd33112863a014d450.exe
Size

195KB
MD5

458b335b1d6a0fcd33112863a014d450
SHA1

a2e8b04155a48538ab798eb28be10e51bab5cb7a
SHA256

bb2b54e9689794cfd40fe2126102203ccb00ee5d3aae22e5f3b6db95cb18f1b9
SHA512

06090b7243b4e64afa12ff14d7893fe950c72fdb0d0ddbf3d0fab348548911c49d48cdb2d5775e417212291faaee0999a828b6dd9c5bc40c1044b35594977327
SSDEEP

3072:7mLy5XClqNrbPY4oLonnMXZKdujCa5BQbXHQSOydRmTgpZWYS2jbxWGqJslB:7w2ylq+b8nnUKAQbXHN1gWXSbGqJwB

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
4748	tmadqjh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\tmadqjh.exe	NEAS.458b335b1d6a0fcd33112863a014d450.exe
File created	C:\PROGRA~3\Mozilla\rjbydkd.dll	tmadqjh.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.458b335b1d6a0fcd33112863a014d450.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.458b335b1d6a0fcd33112863a014d450.exe"
1⤵
- Drops file in Program Files directory
PID:1604

C:\PROGRA~3\Mozilla\tmadqjh.exe
C:\PROGRA~3\Mozilla\tmadqjh.exe -gglpwzh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\tmadqjh.exe

Filesize
195KB

MD5
38224d691c2d4deb82656f020794019d

SHA1
bd81d51bf8e822cd5f50bfd1c4f189040c3222f2

SHA256
78cbfaa0f4c03b2d4abb722559bf061eaa7286267c6bd6c816ef591747da9c01

SHA512
6f17370b057b433544b67250f2d4d3217b2f39ed832b68ecaf614dc8463dd7d30f67d77d317e0bd833cf98953fcaee72c607df80e8a2cceeecacb4560a864603

Download Submit
C:\ProgramData\Mozilla\tmadqjh.exe

Filesize
195KB

MD5
38224d691c2d4deb82656f020794019d

SHA1
bd81d51bf8e822cd5f50bfd1c4f189040c3222f2

SHA256
78cbfaa0f4c03b2d4abb722559bf061eaa7286267c6bd6c816ef591747da9c01

SHA512
6f17370b057b433544b67250f2d4d3217b2f39ed832b68ecaf614dc8463dd7d30f67d77d317e0bd833cf98953fcaee72c607df80e8a2cceeecacb4560a864603

Download Submit
memory/1604-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1604-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/1604-2-0x0000000002210000-0x000000000226C000-memory.dmp

Filesize
368KB

Download
memory/1604-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1604-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1604-12-0x0000000002210000-0x000000000226C000-memory.dmp

Filesize
368KB

Download
memory/4748-7-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4748-11-0x0000000000DF0000-0x0000000000E4C000-memory.dmp

Filesize
368KB

Download
memory/4748-13-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4748-8-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/4748-15-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download