Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 13:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38870718b00f8c1a8805c749a7bd25d5.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
38870718b00f8c1a8805c749a7bd25d5.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
38870718b00f8c1a8805c749a7bd25d5.exe
-
Size
80KB
-
MD5
38870718b00f8c1a8805c749a7bd25d5
-
SHA1
8a994c7ca298c208ec5335dfa70924825476de24
-
SHA256
29ad44098ae43b5be9ceb1d62686ad32b13675381c8549d6ef7abe1818cb67df
-
SHA512
e5979a2e2306ab88af21d437071601797395b80ce577125f969adfdf3b29423e2dd83a9aa25d5b2f60cb7192a0d9e8eadbbe2ce47155c44f24b7de672985c85c
-
SSDEEP
1536:vL7wLwvKGlTGQxguIxZTAwlpwFJ0T72mocT:DowvrKxZfUFJ0T72mBT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 38870718b00f8c1a8805c749a7bd25d5.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neabu.exe -
Executes dropped EXE 1 IoCs
pid Process 1796 neabu.exe -
Loads dropped DLL 2 IoCs
pid Process 2064 38870718b00f8c1a8805c749a7bd25d5.exe 2064 38870718b00f8c1a8805c749a7bd25d5.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /k" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /j" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /w" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /z" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /m" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /x" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /f" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /n" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /d" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /h" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /u" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /a" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /r" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /q" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /o" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /i" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /c" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /g" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /b" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /q" 38870718b00f8c1a8805c749a7bd25d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /l" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /v" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /e" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /t" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /p" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /y" neabu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\neabu = "C:\\Users\\Admin\\neabu.exe /s" neabu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2064 38870718b00f8c1a8805c749a7bd25d5.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe 1796 neabu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2064 38870718b00f8c1a8805c749a7bd25d5.exe 1796 neabu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1796 2064 38870718b00f8c1a8805c749a7bd25d5.exe 28 PID 2064 wrote to memory of 1796 2064 38870718b00f8c1a8805c749a7bd25d5.exe 28 PID 2064 wrote to memory of 1796 2064 38870718b00f8c1a8805c749a7bd25d5.exe 28 PID 2064 wrote to memory of 1796 2064 38870718b00f8c1a8805c749a7bd25d5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\38870718b00f8c1a8805c749a7bd25d5.exe"C:\Users\Admin\AppData\Local\Temp\38870718b00f8c1a8805c749a7bd25d5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\neabu.exe"C:\Users\Admin\neabu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD51ccccbe8c31f0c7fc54df6a350f56f03
SHA1b909f1030cf68d43117f669e5b835c50ce30a9da
SHA256c5ba714388b3545bc0153b3842f2cf4acbb978761195b931172b1b0d881e3ee2
SHA5127b9c7ace1ed1aaac66b56ab0ba65152931ced7a1ce6fd7a05550f94c7b625484dd7145f12beb87d40ec42b2872f349e12394b2455fc197b401ea8ff89bd978a2
-
Filesize
80KB
MD5a807168c9854597d70d234cef290498a
SHA1d3f0cb8b92e8a835232fd9c246c2e2518d1aa4a1
SHA256a16fd678f276bc0a7ea37ba97843229d689929cf569838243a7d7ef5a576903d
SHA51276f1c1b8711d720f8b5426a806b85f6088661de0438008ac763f9c02bfab314ed86315117988a1829245fc7e4555ebf27d4627145a5b46b0e3c02884ef18b57f