ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6

Analysis

max time kernel
16s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/05/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30aa5126abda19531174323dff513c80_NEAS.exe
Size

24KB
MD5

30aa5126abda19531174323dff513c80
SHA1

992ec6ca6dfbe8a92980e0a9e344ad089c4ded53
SHA256

ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6
SHA512

f41e9f34834220a6e331a47eb35420a7b64e30630007e3ac15c5abf01246290e8dfe8a9a39f6bf3b1020ab37f98247fdd55766c1dad840f89b0f6c7afac95398
SSDEEP

384:+7ZfapsmVHgRK/rJ1OetA8gA49lBrenVyG+txHBtNsmSJJEFk2:OpgTARK/rRggVGhBRAEy2

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2176	updatepdf.exe

Loads dropped DLL 4 IoCs

pid	Process
2036	30aa5126abda19531174323dff513c80_NEAS.exe
2176	updatepdf.exe
2176	updatepdf.exe
2176	updatepdf.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2176	2036	30aa5126abda19531174323dff513c80_NEAS.exe	28
PID 2036 wrote to memory of 2176	2036	30aa5126abda19531174323dff513c80_NEAS.exe	28
PID 2036 wrote to memory of 2176	2036	30aa5126abda19531174323dff513c80_NEAS.exe	28
PID 2036 wrote to memory of 2176	2036	30aa5126abda19531174323dff513c80_NEAS.exe	28
PID 2036 wrote to memory of 2176	2036	30aa5126abda19531174323dff513c80_NEAS.exe	28
PID 2036 wrote to memory of 2176	2036	30aa5126abda19531174323dff513c80_NEAS.exe	28
PID 2036 wrote to memory of 2176	2036	30aa5126abda19531174323dff513c80_NEAS.exe	28

C:\Users\Admin\AppData\Local\Temp\30aa5126abda19531174323dff513c80_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\30aa5126abda19531174323dff513c80_NEAS.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\updatepdf.exe
  "C:\Users\Admin\AppData\Local\Temp\updatepdf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\updatepdf.exe

Filesize
24KB

MD5
a6fa7c8a2dd95d92e8a543f8d07b68f0

SHA1
39b9a2c7a15c8be4d6ef055a347d2daec5857f7c

SHA256
c6f47a98eb4022af489ae2ab1ad3d08f2fba9c2e0ebbb04bf0e4fe3b80ca20ad

SHA512
4949ec764d8215be2e3c827db6d316b5206cefa614dfc0b4439a3544f5b8872c51dd4b3ba0f6a5816304e4cd88b602fdd5eadfc03d60728612e7023db4c1ace7

Download Submit
memory/2036-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download