Analysis

  • max time kernel
    122s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    16-11-2023 11:41

General

  • Target

    NEAS.a20fbac01eef69e233cab1b3a23c1570.exe

  • Size

    577KB

  • MD5

    a20fbac01eef69e233cab1b3a23c1570

  • SHA1

    a7c123bd3f2b31b3011ffcba7bf18ab9f7440171

  • SHA256

    e417e584e89c4cf141cbd894825579c28648e2cddc096201203d3e6d9a86f94c

  • SHA512

    bc7d4b9498f40f65ca1c45885d052a1acd640e52de7e453b343f5a113fc6b80e365376d86daa1343c8b931e68ecf8f7f2faf2ef29ece81c9c0981dde217f09e1

  • SSDEEP

    12288:NUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3Y:Nt2rR8FfBhRJUEbDk1ulUI

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.a20fbac01eef69e233cab1b3a23c1570.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a20fbac01eef69e233cab1b3a23c1570.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1736-0-0x0000000100000000-0x0000000100095000-memory.dmp

    Filesize

    596KB

  • memory/1736-1-0x0000000000250000-0x00000000002B0000-memory.dmp

    Filesize

    384KB

  • memory/1736-8-0x0000000000250000-0x00000000002B0000-memory.dmp

    Filesize

    384KB

  • memory/1736-7-0x0000000000250000-0x00000000002B0000-memory.dmp

    Filesize

    384KB

  • memory/1736-13-0x0000000100000000-0x0000000100095000-memory.dmp

    Filesize

    596KB

  • memory/1736-11-0x0000000000250000-0x00000000002B0000-memory.dmp

    Filesize

    384KB