Analysis
-
max time kernel
155s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.ddfae6f41d5c1493216ed66603bdd380.exe
Resource
win7-20231023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.ddfae6f41d5c1493216ed66603bdd380.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
NEAS.ddfae6f41d5c1493216ed66603bdd380.exe
-
Size
1.2MB
-
MD5
ddfae6f41d5c1493216ed66603bdd380
-
SHA1
ee9927621a4a33a2433d99db62ffb6b70adcbf7e
-
SHA256
554b1174b778c9bf4b57b83770dcc78166e8b0691cb8002e8765d47ed2900a45
-
SHA512
e49119e88efb74b2496d1e80f410435f8d18e65087fdc56202256a66ee45430f7d33887d4ed7130cf05a8b0ad2ef393a5cadbbf6b78941031c9d78041ebbe6b3
-
SSDEEP
24576:YfZanlLXYSKEDRWTg+YeP/YkOqLKqbt6MGYwMNEer:YPSKRM+Y2ZPLpgnMNE+
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1356-0-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-1-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-2-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-3-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-5-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-7-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-9-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-11-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-13-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-15-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-17-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-19-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-21-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-24-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-26-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-28-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-31-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-37-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-35-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-33-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-39-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-41-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-43-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-45-0x0000000000380000-0x00000000003BE000-memory.dmp upx behavioral1/memory/1356-46-0x0000000000380000-0x00000000003BE000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe 1356 NEAS.ddfae6f41d5c1493216ed66603bdd380.exe