Analysis
-
max time kernel
158s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
15-11-2023 03:36
General
-
Target
NEAS.ada63bea8832d17f199a0bd651fff230.exe
-
Size
3.7MB
-
MD5
ada63bea8832d17f199a0bd651fff230
-
SHA1
93e9767bda2c8db60f31130a0e15a769e483d9d3
-
SHA256
b24871aea30a4abd8828ff4201cbc655681d21bec634b54bf7d03a9efe0e311c
-
SHA512
74e57e01a1651978cb933d9889bceff704d6386326cbbcf053d3850cd560c99e759eaa2e9764209224d6414d91645443153d1404342dedaa4f7a78d0ca0ecf2f
-
SSDEEP
98304:z8qvE2eJX+0ngCSSL6PmFmYrWrUj+ZtPDXU2he0psU:z8uedZgFSv1rFjQDXU2XpsU
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 8 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ada63bea8832d17f199a0bd651fff230.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ada63bea8832d17f199a0bd651fff230.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ada63bea8832d17f199a0bd651fff230.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ada63bea8832d17f199a0bd651fff230.exe" -sfxwaitall:0 "uTorrent.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\uTorrent.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\uTorrent.exe"3⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
154KB
MD50f117d2bcc964873174a046f044df0f4
SHA1fd1c546ca3aa603319d5dd8e475c0f79e01bd4f3
SHA256b6d0c98ed7728d743019a9f3b1321986adc05c6f11d4be8437f931e1a6a52d72
SHA5126440fbbfc0bec22a232c769d7d91bc0ff6f355d7cae7dc270d4656065f5c0977e51436f10e6c553e063386689ef52d3af3c36db22af7740b4b71241bb44710b1
-
Filesize
9KB
MD5b80acc761c7b6e79f07c025428ae1bba
SHA105644594a68db487be3f568737a34f72f6043ac9
SHA25616084d4d50747faa7fd27d255fc10d6694e451cb57643fed369251930e09f618
SHA51292c689f2121e59a19873ffb6be5bd96a6d33a0e36af8ee654d5524ea6bc750858c764df70e9c05b3c49f9dfaa5bd3064a24dd6c8adf387e74d2b3917b200d501
-
Filesize
10KB
MD5f00cf69026cdd8814dcf5ebd6bf98e61
SHA1d289c2c572365bedfa65a0b2353fde62a7d0b992
SHA25606c24a74717ec408eb31bf2093a6464b705e98f1612be94d7190f689a4c2a5d6
SHA512934356a38f75947efa9676aa62af8f18a7a9af933745503abfd00e23c25c929ccd21a05220e50e3df9c01e449f2f0876f451cb183e862048a1cf509608261372
-
Filesize
18KB
MD51d9efef1b6daf70bbb2fd20caf94de31
SHA1732ce338a9b2f88e48f056d356186551c1a43c12
SHA256159ed23b80047b0ec7ad80bc1cfd06c555964783114a61589a4e62e9cf24ba9a
SHA51209341c9861bcbfc8a1b3c82d4759f518cddfa95aa8346cf1107f982f2921943d390baf051b4017d37f6e7b5b5b4821803e2248f797364dac7ec9290dd5edb8d9
-
Filesize
17KB
MD5c48d6b3e3db520627f286eea0cbff3c2
SHA1fc40a3eebc1da22015837c204f94c21404dac02e
SHA2567d86bcb069e9b2601d91c7cd2e0128b1694f8539fda4ff348e836ddf16cf3345
SHA5128cb082ee29d2fcd82b0257d2e3304319bc52b9e510f923cb8f2888e9dfaedc97eb96b04f09f2799806aead7fbd1f4341303c3ad3a5854aa998f4d441b7f316d8
-
Filesize
9KB
MD5b80acc761c7b6e79f07c025428ae1bba
SHA105644594a68db487be3f568737a34f72f6043ac9
SHA25616084d4d50747faa7fd27d255fc10d6694e451cb57643fed369251930e09f618
SHA51292c689f2121e59a19873ffb6be5bd96a6d33a0e36af8ee654d5524ea6bc750858c764df70e9c05b3c49f9dfaa5bd3064a24dd6c8adf387e74d2b3917b200d501
-
Filesize
4.5MB
MD5bfefeac4bc2447bfda3ab718200db2e9
SHA149aa1da5becb748d974c71673ec497d8e63ad6b6
SHA2561f39d582ff6e6ab4af6c377670c9e8c2b1859f0c2484b1cd9c28629c652161dd
SHA5128b9f30417d78f4c999c63932ea57ad12660dfd59d4fc1d0e323e7af99025761fcf1a072387d3c8b5ce61599a8f94611f8c8831fd180e7d426a3a0d36478b616a
-
Filesize
4.5MB
MD5bfefeac4bc2447bfda3ab718200db2e9
SHA149aa1da5becb748d974c71673ec497d8e63ad6b6
SHA2561f39d582ff6e6ab4af6c377670c9e8c2b1859f0c2484b1cd9c28629c652161dd
SHA5128b9f30417d78f4c999c63932ea57ad12660dfd59d4fc1d0e323e7af99025761fcf1a072387d3c8b5ce61599a8f94611f8c8831fd180e7d426a3a0d36478b616a
-
Filesize
4.6MB
MD5f94c676c6c2ccc06c07d5e00a031689a
SHA114dee2f72e75f1c29ed1189a135417d1d6851098
SHA256897c0e672dc499a968d9b9116af56c4ae5ed5bd81601ee37ae2f9c7534c696d1
SHA512481c9a6404158900b498fa1e871fcf1c03a68a1e8801ea7988770a3255f7464df12be7ae46c6e26296adf0f28f97a476605f400940bc5b2df1e142eab7c71b4f
-
Filesize
4.6MB
MD5f94c676c6c2ccc06c07d5e00a031689a
SHA114dee2f72e75f1c29ed1189a135417d1d6851098
SHA256897c0e672dc499a968d9b9116af56c4ae5ed5bd81601ee37ae2f9c7534c696d1
SHA512481c9a6404158900b498fa1e871fcf1c03a68a1e8801ea7988770a3255f7464df12be7ae46c6e26296adf0f28f97a476605f400940bc5b2df1e142eab7c71b4f
-
Filesize
4.6MB
MD5f94c676c6c2ccc06c07d5e00a031689a
SHA114dee2f72e75f1c29ed1189a135417d1d6851098
SHA256897c0e672dc499a968d9b9116af56c4ae5ed5bd81601ee37ae2f9c7534c696d1
SHA512481c9a6404158900b498fa1e871fcf1c03a68a1e8801ea7988770a3255f7464df12be7ae46c6e26296adf0f28f97a476605f400940bc5b2df1e142eab7c71b4f
-
Filesize
1.3MB
MD580e85e634b7772686655f1be930da07d
SHA133327e9006450eac668bb72653f886ac304b1fed
SHA2567b879aa4253676a4d7cb3f5d5dd1af93f8d2756276de72130aec06fe96828ed5
SHA512e2df3e2f41c5410642f0cc91052b9e016ffde7755a5fca6f2b17640446260e5f4953f564e6b2de20e74632078d87de47b3d4fec34e3ecca7fa1475cec8ae3270
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
4.8MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
652KB
-
Filesize
192KB
-
Filesize
652KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
396KB
-
Filesize
652KB
-
Filesize
192KB
-
Filesize
396KB
-
Filesize
192KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
652KB
-
Filesize
192KB
-
Filesize
396KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
396KB