e38f65359fb6e9f99fdfe217296705a84bffbe600a2ab038a4a55da3fca22510

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84922de07987b01f301afd10d1aa2ec0_NEAS.exe
Size

5.1MB
MD5

84922de07987b01f301afd10d1aa2ec0
SHA1

bea69f2d4f7149ef905217783cede6f305a5bbb8
SHA256

e38f65359fb6e9f99fdfe217296705a84bffbe600a2ab038a4a55da3fca22510
SHA512

8ffb445701b8b8aa86ede8af41fcdf34a32fe776e1cdc64fc39313a577460bd0f2d7cffed5724075af9c056f2d65f9c8b100ffdb1265d0f771ba21642ea9e5e0
SSDEEP

98304:FOcxcbX2ZoJqwuURhT+7kyhTndQL3ePehT+7kyhT:F3cMscXpdQjeGcX

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2456	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
2456	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Loads dropped DLL 1 IoCs

pid	Process
1904	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2456	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1904	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2456	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2456	1904	84922de07987b01f301afd10d1aa2ec0_NEAS.exe	29
PID 1904 wrote to memory of 2456	1904	84922de07987b01f301afd10d1aa2ec0_NEAS.exe	29
PID 1904 wrote to memory of 2456	1904	84922de07987b01f301afd10d1aa2ec0_NEAS.exe	29
PID 1904 wrote to memory of 2456	1904	84922de07987b01f301afd10d1aa2ec0_NEAS.exe	29

C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe
  C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Filesize
5.1MB

MD5
f329874c7811079708902ad3bfbeaed6

SHA1
8b8398e6759bd513d67a10ec7d8450fe62786f03

SHA256
d8c85df10096591ba43868d0338a769047c4952427367461c53668f83e5e864a

SHA512
483b16132b7475a302e1c9ec1d38eafd1bed6cf3756f653810bb61e8dbc601a1c6274d177d61152f98043c3f4a28d3f90427a4977b9a3e58f365bb2d0dc1a73e

Download Submit
memory/1904-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1904-6-0x0000000003790000-0x000000000387F000-memory.dmp

Filesize
956KB

Download
memory/1904-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2456-9-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2456-17-0x0000000002E00000-0x0000000002EEF000-memory.dmp

Filesize
956KB

Download
memory/2456-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2456-39-0x0000000009730000-0x00000000097D3000-memory.dmp

Filesize
652KB

Download
memory/2456-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download