Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 16:00
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe
Resource
win10v2004-20231127-en
General
-
Target
NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe
-
Size
308KB
-
MD5
6f331f4edfa3feb15f68bb9f9fb15ff9
-
SHA1
31c86ab64f80518fff5b3a9d824c5e2220b2c466
-
SHA256
60b0ef6574d0a7a30ee5b4fbbf7c1709994e9f3ae276359b8a335930df9dd29c
-
SHA512
08e19565b38b034c0912d61264725e7fec2c4c25c0536c6a5408a8a23f27b5ae6f9a24fe091197e72da6d36797c006010d9977cb4a25ddf87bc17db5f53deaf9
-
SSDEEP
3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
csrsll.exepid process 2996 csrsll.exe -
Loads dropped DLL 5 IoCs
Processes:
NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exepid process 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe -
Processes:
resource yara_rule behavioral1/memory/2180-147670-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2180-147673-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2180-147676-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2180-147674-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2180-147672-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2180-147666-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2180-147664-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2180-167678-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exedescription pid process target process PID 2660 set thread context of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exeNEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.execsrsll.exepid process 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe 2996 csrsll.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exeNEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.execmd.exedescription pid process target process PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2660 wrote to memory of 2180 2660 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe PID 2180 wrote to memory of 2064 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe cmd.exe PID 2180 wrote to memory of 2064 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe cmd.exe PID 2180 wrote to memory of 2064 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe cmd.exe PID 2180 wrote to memory of 2064 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe cmd.exe PID 2064 wrote to memory of 2684 2064 cmd.exe reg.exe PID 2064 wrote to memory of 2684 2064 cmd.exe reg.exe PID 2064 wrote to memory of 2684 2064 cmd.exe reg.exe PID 2064 wrote to memory of 2684 2064 cmd.exe reg.exe PID 2180 wrote to memory of 2996 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe csrsll.exe PID 2180 wrote to memory of 2996 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe csrsll.exe PID 2180 wrote to memory of 2996 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe csrsll.exe PID 2180 wrote to memory of 2996 2180 NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6f331f4edfa3feb15f68bb9f9fb15ff9.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BMRNB.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BMRNB.batFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Local\Temp\BMRNB.batFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD514f23db01896a2f221a5c5c4cfb55d9b
SHA1ccb92caa84eff70d652f9093a2eb17acac56027f
SHA2566468f1fdeb2726184662117df118f8f8c7867877685bd90d7f601e66e1a5fa4a
SHA5126c178868f475846d57e9069485a03d3648402abfb63a2c676808414c76ba526a666fb1e638896be7dd69de0010012783c21bc6ab5d277216b68b488e96853ffb
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD514f23db01896a2f221a5c5c4cfb55d9b
SHA1ccb92caa84eff70d652f9093a2eb17acac56027f
SHA2566468f1fdeb2726184662117df118f8f8c7867877685bd90d7f601e66e1a5fa4a
SHA5126c178868f475846d57e9069485a03d3648402abfb63a2c676808414c76ba526a666fb1e638896be7dd69de0010012783c21bc6ab5d277216b68b488e96853ffb
-
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD514f23db01896a2f221a5c5c4cfb55d9b
SHA1ccb92caa84eff70d652f9093a2eb17acac56027f
SHA2566468f1fdeb2726184662117df118f8f8c7867877685bd90d7f601e66e1a5fa4a
SHA5126c178868f475846d57e9069485a03d3648402abfb63a2c676808414c76ba526a666fb1e638896be7dd69de0010012783c21bc6ab5d277216b68b488e96853ffb
-
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD514f23db01896a2f221a5c5c4cfb55d9b
SHA1ccb92caa84eff70d652f9093a2eb17acac56027f
SHA2566468f1fdeb2726184662117df118f8f8c7867877685bd90d7f601e66e1a5fa4a
SHA5126c178868f475846d57e9069485a03d3648402abfb63a2c676808414c76ba526a666fb1e638896be7dd69de0010012783c21bc6ab5d277216b68b488e96853ffb
-
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD514f23db01896a2f221a5c5c4cfb55d9b
SHA1ccb92caa84eff70d652f9093a2eb17acac56027f
SHA2566468f1fdeb2726184662117df118f8f8c7867877685bd90d7f601e66e1a5fa4a
SHA5126c178868f475846d57e9069485a03d3648402abfb63a2c676808414c76ba526a666fb1e638896be7dd69de0010012783c21bc6ab5d277216b68b488e96853ffb
-
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD514f23db01896a2f221a5c5c4cfb55d9b
SHA1ccb92caa84eff70d652f9093a2eb17acac56027f
SHA2566468f1fdeb2726184662117df118f8f8c7867877685bd90d7f601e66e1a5fa4a
SHA5126c178868f475846d57e9069485a03d3648402abfb63a2c676808414c76ba526a666fb1e638896be7dd69de0010012783c21bc6ab5d277216b68b488e96853ffb
-
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD514f23db01896a2f221a5c5c4cfb55d9b
SHA1ccb92caa84eff70d652f9093a2eb17acac56027f
SHA2566468f1fdeb2726184662117df118f8f8c7867877685bd90d7f601e66e1a5fa4a
SHA5126c178868f475846d57e9069485a03d3648402abfb63a2c676808414c76ba526a666fb1e638896be7dd69de0010012783c21bc6ab5d277216b68b488e96853ffb
-
memory/2180-147670-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-147666-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-147662-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-147674-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-147676-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-147673-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-167678-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-147664-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2180-147668-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2180-147672-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2660-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2660-147661-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/2660-3-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2996-147716-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2996-193357-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB