Overview

overview

8

Static

static

3

NEAS.971a3...60.exe

windows7-x64

8

NEAS.971a3...60.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.971a31fc9fc974f062ba1a0c01bcba60.exe

  • Size

    5.0MB

  • Sample

    231117-c44r4adg37

  • MD5

    971a31fc9fc974f062ba1a0c01bcba60

  • SHA1

    642f1f925e9e3ad0e92e9c5497a43ce345dd7701

  • SHA256

    5e82f511ae5883cbdaeefa0fdf0d8965c9cc7b7b1375a1b790b6e9472a5f0095

  • SHA512

    ab5b088e057c6b6bc8b869f9fa4ef3ef379b273ed356ab7f6fe09abdce389a3897e57c22b555469d1d528bd016bbc74e27ccb1139c8f3db884880115a52625f9

  • SSDEEP

    98304:x/Ci//7TtSqpI25OkRtRnf+x1l/Lxhsd9m9Kefw8V8zl:xKirN75OkRLm9xXd5VK

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      NEAS.971a31fc9fc974f062ba1a0c01bcba60.exe

    • Size

      5.0MB

    • MD5

      971a31fc9fc974f062ba1a0c01bcba60

    • SHA1

      642f1f925e9e3ad0e92e9c5497a43ce345dd7701

    • SHA256

      5e82f511ae5883cbdaeefa0fdf0d8965c9cc7b7b1375a1b790b6e9472a5f0095

    • SHA512

      ab5b088e057c6b6bc8b869f9fa4ef3ef379b273ed356ab7f6fe09abdce389a3897e57c22b555469d1d528bd016bbc74e27ccb1139c8f3db884880115a52625f9

    • SSDEEP

      98304:x/Ci//7TtSqpI25OkRtRnf+x1l/Lxhsd9m9Kefw8V8zl:xKirN75OkRLm9xXd5VK

    Score
    8/10
    persistenceupxdiscovery

    • Modifies AppInit DLL entries

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks