Analysis
-
max time kernel
69s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09-01-2024 14:44
Static task
static1
Behavioral task
behavioral1
Sample
4e93205ab202f5e3f637a6babbc5bd1e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4e93205ab202f5e3f637a6babbc5bd1e.exe
Resource
win10v2004-20231222-en
General
-
Target
4e93205ab202f5e3f637a6babbc5bd1e.exe
-
Size
293KB
-
MD5
4e93205ab202f5e3f637a6babbc5bd1e
-
SHA1
78dbc5730e69dbbcb14e1e73762647430a7bd555
-
SHA256
3119a59dc13e0fbc43b15b6321ac115c0098de4abcdd2d68367f1174c158ec33
-
SHA512
8e02d6e88f07eb853588d73ef7c51ca861796824bcae0107bc5f48a0985cc63afee53b9d30f327bcc43cdac090ecbe56e65015c2a6eb8942cfd49ba672e85e56
-
SSDEEP
6144:XPdMYMANEVzGlcEDUl4qaRYVQxJTGbusJRhgnGXcTD7Xm2BeddhMHXoH/:5NEh8cSLqdasisDhgnGsBBedDM3of
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
egaxg.exepid process 2264 egaxg.exe -
Loads dropped DLL 2 IoCs
Processes:
4e93205ab202f5e3f637a6babbc5bd1e.exepid process 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
egaxg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\{40C758C8-CEFB-AD4E-7138-F2B16CEAD1AC} = "C:\\Users\\Admin\\AppData\\Roaming\\Neid\\egaxg.exe" egaxg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4e93205ab202f5e3f637a6babbc5bd1e.exedescription pid process target process PID 1896 set thread context of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1608 2892 WerFault.exe cmd.exe -
Processes:
4e93205ab202f5e3f637a6babbc5bd1e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Privacy 4e93205ab202f5e3f637a6babbc5bd1e.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 4e93205ab202f5e3f637a6babbc5bd1e.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
egaxg.exepid process 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe 2264 egaxg.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4e93205ab202f5e3f637a6babbc5bd1e.exedescription pid process Token: SeSecurityPrivilege 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe Token: SeSecurityPrivilege 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe Token: SeSecurityPrivilege 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
4e93205ab202f5e3f637a6babbc5bd1e.exeegaxg.exepid process 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe 2264 egaxg.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
4e93205ab202f5e3f637a6babbc5bd1e.exeegaxg.execmd.exedescription pid process target process PID 1896 wrote to memory of 2264 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe egaxg.exe PID 1896 wrote to memory of 2264 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe egaxg.exe PID 1896 wrote to memory of 2264 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe egaxg.exe PID 1896 wrote to memory of 2264 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe egaxg.exe PID 2264 wrote to memory of 1056 2264 egaxg.exe taskhost.exe PID 2264 wrote to memory of 1056 2264 egaxg.exe taskhost.exe PID 2264 wrote to memory of 1056 2264 egaxg.exe taskhost.exe PID 2264 wrote to memory of 1056 2264 egaxg.exe taskhost.exe PID 2264 wrote to memory of 1056 2264 egaxg.exe taskhost.exe PID 2264 wrote to memory of 1112 2264 egaxg.exe Dwm.exe PID 2264 wrote to memory of 1112 2264 egaxg.exe Dwm.exe PID 2264 wrote to memory of 1112 2264 egaxg.exe Dwm.exe PID 2264 wrote to memory of 1112 2264 egaxg.exe Dwm.exe PID 2264 wrote to memory of 1112 2264 egaxg.exe Dwm.exe PID 2264 wrote to memory of 1164 2264 egaxg.exe Explorer.EXE PID 2264 wrote to memory of 1164 2264 egaxg.exe Explorer.EXE PID 2264 wrote to memory of 1164 2264 egaxg.exe Explorer.EXE PID 2264 wrote to memory of 1164 2264 egaxg.exe Explorer.EXE PID 2264 wrote to memory of 1164 2264 egaxg.exe Explorer.EXE PID 2264 wrote to memory of 1784 2264 egaxg.exe DllHost.exe PID 2264 wrote to memory of 1784 2264 egaxg.exe DllHost.exe PID 2264 wrote to memory of 1784 2264 egaxg.exe DllHost.exe PID 2264 wrote to memory of 1784 2264 egaxg.exe DllHost.exe PID 2264 wrote to memory of 1784 2264 egaxg.exe DllHost.exe PID 2264 wrote to memory of 1896 2264 egaxg.exe 4e93205ab202f5e3f637a6babbc5bd1e.exe PID 2264 wrote to memory of 1896 2264 egaxg.exe 4e93205ab202f5e3f637a6babbc5bd1e.exe PID 2264 wrote to memory of 1896 2264 egaxg.exe 4e93205ab202f5e3f637a6babbc5bd1e.exe PID 2264 wrote to memory of 1896 2264 egaxg.exe 4e93205ab202f5e3f637a6babbc5bd1e.exe PID 2264 wrote to memory of 1896 2264 egaxg.exe 4e93205ab202f5e3f637a6babbc5bd1e.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 1896 wrote to memory of 2892 1896 4e93205ab202f5e3f637a6babbc5bd1e.exe cmd.exe PID 2892 wrote to memory of 1608 2892 cmd.exe WerFault.exe PID 2892 wrote to memory of 1608 2892 cmd.exe WerFault.exe PID 2892 wrote to memory of 1608 2892 cmd.exe WerFault.exe PID 2892 wrote to memory of 1608 2892 cmd.exe WerFault.exe PID 2264 wrote to memory of 1156 2264 egaxg.exe conhost.exe PID 2264 wrote to memory of 1156 2264 egaxg.exe conhost.exe PID 2264 wrote to memory of 1156 2264 egaxg.exe conhost.exe PID 2264 wrote to memory of 1156 2264 egaxg.exe conhost.exe PID 2264 wrote to memory of 1156 2264 egaxg.exe conhost.exe PID 2264 wrote to memory of 1608 2264 egaxg.exe WerFault.exe PID 2264 wrote to memory of 1608 2264 egaxg.exe WerFault.exe PID 2264 wrote to memory of 1608 2264 egaxg.exe WerFault.exe PID 2264 wrote to memory of 1608 2264 egaxg.exe WerFault.exe PID 2264 wrote to memory of 1608 2264 egaxg.exe WerFault.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1112
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp43bc55a1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1122⤵
- Program crash
PID:1608
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "745386958357532215-1111961637-27750082064419882-4824000289213554472026265096"1⤵PID:1156
-
C:\Users\Admin\AppData\Roaming\Neid\egaxg.exe"C:\Users\Admin\AppData\Roaming\Neid\egaxg.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2264
-
C:\Users\Admin\AppData\Local\Temp\4e93205ab202f5e3f637a6babbc5bd1e.exe"C:\Users\Admin\AppData\Local\Temp\4e93205ab202f5e3f637a6babbc5bd1e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1896
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1784
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1164
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1056