Analysis

  • max time kernel
    16s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2024, 23:28

General

  • Target

    30aa5126abda19531174323dff513c80_NEAS.exe

  • Size

    24KB

  • MD5

    30aa5126abda19531174323dff513c80

  • SHA1

    992ec6ca6dfbe8a92980e0a9e344ad089c4ded53

  • SHA256

    ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6

  • SHA512

    f41e9f34834220a6e331a47eb35420a7b64e30630007e3ac15c5abf01246290e8dfe8a9a39f6bf3b1020ab37f98247fdd55766c1dad840f89b0f6c7afac95398

  • SSDEEP

    384:+7ZfapsmVHgRK/rJ1OetA8gA49lBrenVyG+txHBtNsmSJJEFk2:OpgTARK/rRggVGhBRAEy2

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30aa5126abda19531174323dff513c80_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\30aa5126abda19531174323dff513c80_NEAS.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\updatepdf.exe
      "C:\Users\Admin\AppData\Local\Temp\updatepdf.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\updatepdf.exe

    Filesize

    24KB

    MD5

    a6fa7c8a2dd95d92e8a543f8d07b68f0

    SHA1

    39b9a2c7a15c8be4d6ef055a347d2daec5857f7c

    SHA256

    c6f47a98eb4022af489ae2ab1ad3d08f2fba9c2e0ebbb04bf0e4fe3b80ca20ad

    SHA512

    4949ec764d8215be2e3c827db6d316b5206cefa614dfc0b4439a3544f5b8872c51dd4b3ba0f6a5816304e4cd88b602fdd5eadfc03d60728612e7023db4c1ace7

  • memory/2036-1-0x0000000000401000-0x0000000000402000-memory.dmp

    Filesize

    4KB