0cb8668de7d337d721abd9758d8a01d5e99661232c329d039d47adf4407ddaa2

Analysis

max time kernel
144s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c9093be111af01307e6928fd97bab90_NEAS.exe
Size

320KB
MD5

5c9093be111af01307e6928fd97bab90
SHA1

3fc6d5c35ca37605a099345820a7b0080f172d20
SHA256

0cb8668de7d337d721abd9758d8a01d5e99661232c329d039d47adf4407ddaa2
SHA512

e90187ea7e4e7de5c19f791a0c0a232dec55fe8b2e794999dba2ff217c3970945fa730723b297896454e3f1effd5b38abd3fbdb7692e8711db35fb69a6834698
SSDEEP

6144:7FLu2oZ1v2i5mXNWIs05EcHvekBdWD53BDu0W7cyqCxSngmMBqfycuPbUl0i5j:pLuLZ1v2i4XNWIs+hveKi53p80npM4dZ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
60	5c9093be111af01307e6928fd97bab90_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
60	5c9093be111af01307e6928fd97bab90_NEAS.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3316	388	WerFault.exe	82
3468	60	WerFault.exe	89
1192	60	WerFault.exe	89
1236	60	WerFault.exe	89
3720	60	WerFault.exe	89
736	60	WerFault.exe	89
1252	60	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
388	5c9093be111af01307e6928fd97bab90_NEAS.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
60	5c9093be111af01307e6928fd97bab90_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 60	388	5c9093be111af01307e6928fd97bab90_NEAS.exe	89
PID 388 wrote to memory of 60	388	5c9093be111af01307e6928fd97bab90_NEAS.exe	89
PID 388 wrote to memory of 60	388	5c9093be111af01307e6928fd97bab90_NEAS.exe	89

C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 384
  2⤵
  - Program crash
  PID:3316
- C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
  C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:60
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 352
    3⤵
    - Program crash
    PID:3468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 768
    3⤵
    - Program crash
    PID:1192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 788
    3⤵
    - Program crash
    PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 776
    3⤵
    - Program crash
    PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 788
    3⤵
    - Program crash
    PID:736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 820
    3⤵
    - Program crash
    PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 388 -ip 388
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 60 -ip 60
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 60 -ip 60
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 60 -ip 60
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 60 -ip 60
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 60 -ip 60
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 60 -ip 60
1⤵
PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe

Filesize
320KB

MD5
a3cdb17446704b660a175f4a26034f83

SHA1
83af06c78ba9e31cf6e126c4b40fa602f463d287

SHA256
b3eb63fec2e6567bc4982a2b90ba2dfc2b8e53bf8224c6fd469b6361b42c5226

SHA512
0ed06b22a8b99cd6ede3d43d3dbb8a6db091b63266681498e7ad5067e8695e4f6e2b1c9cf7f9d667e1147e4b1d16ad6a9054b93b2d77818226256f58167444d1

Download Submit
memory/60-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/60-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/60-13-0x0000000004DA0000-0x0000000004DDC000-memory.dmp

Filesize
240KB

Download
memory/388-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/388-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download