Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2023, 23:57

General

  • Target

    NEAS.1d23b39878f2eb3d6ed918f1a904bba0.exe

  • Size

    40KB

  • MD5

    1d23b39878f2eb3d6ed918f1a904bba0

  • SHA1

    40dd14676f2f054ed87b499e128832142d0005f5

  • SHA256

    5fd778051642ee46a4b457668ae104ef4f06b7e9992326e28a1f8901c71b4fd7

  • SHA512

    8514aeabebd6b4fb10d0830aeaf1cd0586d43c6aaee6e9ea6a77f50a3a9d4cb194ddf2e63a817201136c68ae51e4a69ba418a846773e88a33e259e76adbbe622

  • SSDEEP

    768:VQJ3lhtykCei0SjggaTsN4+zqM9LR3TO9GZydalfuV3lVwz0Snbc:V2lhAvei0LSd1hR369GOaFufVwgqc

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.1d23b39878f2eb3d6ed918f1a904bba0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d23b39878f2eb3d6ed918f1a904bba0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C WMIC OS get Caption,OSArchitecture,Version /Format:table & WMIC BIOS Get Manufacturer,Name /Format:table & WMIC Baseboard Get Product,Manufacturer /Format:table & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors /Format:table & WMIC Memorychip Get Manufacturer,Capacity,Speed,PartNumber /Format:table & WMIC Diskdrive Get Model,Size /Format:table & WMIC Path Win32_VideoController get Caption,VideoModeDescription /Format:table & WMIC netuse get Name /Format:table
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC OS get Caption,OSArchitecture,Version /Format:table
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2088
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC BIOS Get Manufacturer,Name /Format:table
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC Baseboard Get Product,Manufacturer /Format:table
        3⤵
          PID:5064
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors /Format:table
          3⤵
            PID:4152
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC Memorychip Get Manufacturer,Capacity,Speed,PartNumber /Format:table
            3⤵
              PID:1520
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC Diskdrive Get Model,Size /Format:table
              3⤵
                PID:3920
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC Path Win32_VideoController get Caption,VideoModeDescription /Format:table
                3⤵
                  PID:212
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC netuse get Name /Format:table
                  3⤵
                    PID:2892

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/4680-0-0x00000000002B0000-0x00000000002C0000-memory.dmp

                Filesize

                64KB

              • memory/4680-1-0x00007FF969030000-0x00007FF969AF1000-memory.dmp

                Filesize

                10.8MB

              • memory/4680-3-0x00007FF969030000-0x00007FF969AF1000-memory.dmp

                Filesize

                10.8MB