Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2023 15:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
037cde8cac40b5de7eec8c6f9d149e2c.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
037cde8cac40b5de7eec8c6f9d149e2c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
037cde8cac40b5de7eec8c6f9d149e2c.exe
-
Size
260KB
-
MD5
037cde8cac40b5de7eec8c6f9d149e2c
-
SHA1
85ea2a77bc93c7edda70cd33dc29b1992fd72f98
-
SHA256
3a41417f6fbac1756a6929f1608f470c4ea2ab69ed434815afb0db788b3e9784
-
SHA512
6f7f31d265fe26ab1e834db00d8633071e2e0949229c2f59388960c61eb18d7adf827cff9bcf657c7489d3c60ea03aefc5a50f84c6202441386628e843f59c69
-
SSDEEP
3072:cgfAlNTvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGVu:cdGgTSrMaIl/jcLijfHFEHWzXvjT85R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neeepem.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 037cde8cac40b5de7eec8c6f9d149e2c.exe -
Executes dropped EXE 1 IoCs
pid Process 3040 neeepem.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /a" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /i" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /s" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /O" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /e" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /h" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /W" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /U" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /n" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /D" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /k" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /p" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /E" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /B" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /R" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /T" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /N" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /Z" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /V" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /t" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /m" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /G" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /L" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /H" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /Y" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /v" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /c" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /u" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /I" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /S" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /g" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /J" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /F" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /j" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /A" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /C" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /M" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /z" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /w" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /P" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /o" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /f" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /Q" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /K" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /b" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /d" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /X" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /y" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /l" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /q" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /x" neeepem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neeepem = "C:\\Users\\Admin\\neeepem.exe /r" neeepem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe 3040 neeepem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3784 037cde8cac40b5de7eec8c6f9d149e2c.exe 3040 neeepem.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3784 wrote to memory of 3040 3784 037cde8cac40b5de7eec8c6f9d149e2c.exe 91 PID 3784 wrote to memory of 3040 3784 037cde8cac40b5de7eec8c6f9d149e2c.exe 91 PID 3784 wrote to memory of 3040 3784 037cde8cac40b5de7eec8c6f9d149e2c.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\037cde8cac40b5de7eec8c6f9d149e2c.exe"C:\Users\Admin\AppData\Local\Temp\037cde8cac40b5de7eec8c6f9d149e2c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\neeepem.exe"C:\Users\Admin\neeepem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD5e3b68f776af26c235a47ac146071f257
SHA1d2417471dc970bfc2734bd14673415eca2806d87
SHA25632b3e23e0063628761c8fea503c761f877af48d48a7625125caf06a20ea28039
SHA51276c94d45f52f04b8c75fc8ab2b73a59df59728d25b859a5a2e8c64d740c863a1474829fd80aae94c00aa416d6a6af8940a439c759114a772a2a9fc3f49043988