NEAS[.]sqlwriter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.sqlwriter.exe
Size

152KB
MD5

0d48b6075cc3a10174ec65cee1c3105d
SHA1

a41ce8313efd01ff6d8b5cd6c7e9f3fa16f646ac
SHA256

8d1d449a0bd5b2085c52e4662e5999d2163f8e2b7a73874329fb4f01a397d7ab
SHA512

235f48e2c3545dc1c742797389db125082af5d8f022895fb7b8b2c3572ba09befe5b33fa823293bb47c8836e387afbe92fa178356c5617a4ca7a7e288f8f93d9
SSDEEP

1536:n5js0oisnm1lWwRIDZpTivY5qC7XcWxIUGXw6B6Ob8c8v+syTBKTF+v6Q:n5I0t+6LUfyFl5JB6XcOnGBKTFk

Score

1^/10

Malware Config

Signatures

Files

NEAS.sqlwriter.exe
.exe windows:6 windows x64

9f71fdff6dab91c7c2115810a9967f30

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:d0:e5:bb:40:5a:c6:57:8c:87:30:03:95:45:60:b9:36:01:2a:c5:35:7d:de:d7:a2:18:34:a4:ba:ee:0f:a4
Signer

Actual PE Digest

e4:d0:e5:bb:40:5a:c6:57:8c:87:30:03:95:45:60:b9:36:01:2a:c5:35:7d:de:d7:a2:18:34:a4:ba:ee:0f:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetHandleInformation
GetModuleFileNameW
CreateMutexW
ReleaseMutex
HeapDestroy
HeapCreate
HeapAlloc
HeapFree
Sleep
LoadLibraryExW
GetSystemInfo
VirtualQuery
ReadProcessMemory
GetThreadPriority
VirtualFree
SetThreadPriority
CreateProcessW
GetExitCodeProcess
GetVersionExW
GetProcAddress
LoadLibraryW
FreeLibrary
OpenThread
DeleteCriticalSection
RaiseException
CloseHandle
SetEvent
GetLastError
CreateEventW
GetCurrentThreadId
WaitForSingleObject
InitializeCriticalSectionEx
GetCommandLineW
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetComputerNameW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetFileSizeEx
WritePrivateProfileStringW
WriteFile
GetPrivateProfileIntW
InitializeCriticalSection
UnlockFileEx
CreateFileW
GetPrivateProfileStringW
GetTimeZoneInformation
GetLocalTime
SetFilePointerEx
MoveFileExW
LockFileEx
GetCurrentProcessId
GetModuleHandleW
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
SetUnhandledExceptionFilter
FlushFileBuffers
GetCurrentProcess
LocalAlloc
GetCurrentThread
LocalFree

user32

MessageBoxW

advapi32

RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorGroup
LookupAccountSidW
GetLengthSid
AddAccessAllowedAceEx
InitializeAcl
InitializeSecurityDescriptor
ReportEventW
RegisterEventSourceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
DeregisterEventSource
AddAce
CopySid
AddAccessDeniedAceEx
GetAce
SetSecurityDescriptorOwner
RegQueryValueExW
SetSecurityDescriptorDacl
GetAclInformation

ole32

CoUninitialize
CoTaskMemAlloc
CoInitializeEx
StringFromGUID2
CoTaskMemFree
CoInitializeSecurity

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__C_specific_handler
memset
_CxxThrowException
_set_se_translator
__CxxFrameHandler3
__C_specific_handler_noexcept
memcpy
memmove

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
realloc
free
_callnewh

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vswprintf
__p__commode

api-ms-win-crt-convert-l1-1-0

_ultoa_s

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
exit
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_register_onexit_function
__p___argc
__p___argv
_resetstkoflw
terminate
_crt_atexit
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcsncat_s
wcsncpy_s
towupper

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s
_wsplitpath_s

Exports

Exports

DmpGetClientExport
DmpRemoteDumpRequest

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f71fdff6dab91c7c2115810a9967f30

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

e4:d0:e5:bb:40:5a:c6:57:8c:87:30:03:95:45:60:b9:36:01:2a:c5:35:7d:de:d7:a2:18:34:a4:ba:ee:0f:a4Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ntdll

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 74KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 8KB - Virtual size: 21KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 264B

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e4:d0:e5:bb:40:5a:c6:57:8c:87:30:03:95:45:60:b9:36:01:2a:c5:35:7d:de:d7:a2:18:34:a4:ba:ee:0f:a4
Signer

.text
Size: 76KB - Virtual size: 74KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 8KB - Virtual size: 21KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 264B