e38f65359fb6e9f99fdfe217296705a84bffbe600a2ab038a4a55da3fca22510

General

Target

84922de07987b01f301afd10d1aa2ec0_NEAS.exe
Size

5.1MB
MD5

84922de07987b01f301afd10d1aa2ec0
SHA1

bea69f2d4f7149ef905217783cede6f305a5bbb8
SHA256

e38f65359fb6e9f99fdfe217296705a84bffbe600a2ab038a4a55da3fca22510
SHA512

8ffb445701b8b8aa86ede8af41fcdf34a32fe776e1cdc64fc39313a577460bd0f2d7cffed5724075af9c056f2d65f9c8b100ffdb1265d0f771ba21642ea9e5e0
SSDEEP

98304:FOcxcbX2ZoJqwuURhT+7kyhTndQL3ePehT+7kyhT:F3cMscXpdQjeGcX

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1852	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
1852	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	pastebin.com
23	pastebin.com

Program crash 16 IoCs

pid	pid_target	Process	procid_target
4864	2980	WerFault.exe	81
3220	1852	WerFault.exe	90
4940	1852	WerFault.exe	90
2372	1852	WerFault.exe	90
4568	1852	WerFault.exe	90
3436	1852	WerFault.exe	90
4216	1852	WerFault.exe	90
1420	1852	WerFault.exe	90
4356	1852	WerFault.exe	90
4456	1852	WerFault.exe	90
820	1852	WerFault.exe	90
2932	1852	WerFault.exe	90
3356	1852	WerFault.exe	90
2584	1852	WerFault.exe	90
3200	1852	WerFault.exe	90
4900	1852	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	84922de07987b01f301afd10d1aa2ec0_NEAS.exe
1852	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2980	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1852	84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1852	2980	84922de07987b01f301afd10d1aa2ec0_NEAS.exe	90
PID 2980 wrote to memory of 1852	2980	84922de07987b01f301afd10d1aa2ec0_NEAS.exe	90
PID 2980 wrote to memory of 1852	2980	84922de07987b01f301afd10d1aa2ec0_NEAS.exe	90

C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 352
  2⤵
  - Program crash
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe
  C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 348
    3⤵
    - Program crash
    PID:3220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 628
    3⤵
    - Program crash
    PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 668
    3⤵
    - Program crash
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 668
    3⤵
    - Program crash
    PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 652
    3⤵
    - Program crash
    PID:3436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 908
    3⤵
    - Program crash
    PID:4216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1408
    3⤵
    - Program crash
    PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1528
    3⤵
    - Program crash
    PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1548
    3⤵
    - Program crash
    PID:4456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1584
    3⤵
    - Program crash
    PID:820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1572
    3⤵
    - Program crash
    PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1560
    3⤵
    - Program crash
    PID:3356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1404
    3⤵
    - Program crash
    PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1088
    3⤵
    - Program crash
    PID:3200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 632
    3⤵
    - Program crash
    PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2980 -ip 2980
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1852 -ip 1852
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1852 -ip 1852
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1852 -ip 1852
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1852 -ip 1852
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1852 -ip 1852
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1852 -ip 1852
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1852 -ip 1852
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1852 -ip 1852
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1852 -ip 1852
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1852 -ip 1852
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1852 -ip 1852
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1852 -ip 1852
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1852 -ip 1852
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1852 -ip 1852
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1852 -ip 1852
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\84922de07987b01f301afd10d1aa2ec0_NEAS.exe

Filesize
5.1MB

MD5
f0bde3ac217b7617d54326faf897afb5

SHA1
dbf803066274fd74d6d5b71e96c99289b9594221

SHA256
38f0349de714a5cf17e37f84cf1ef44bbc95a400c7b472ed2e9f8083b5c9c1bf

SHA512
85fbaf275614a5953edf144fa3e77dd39cdc7135441393f84afda47b8f546ddcae9ccf70512ff15877157c611360367e6a9934bedbf10a3b02861de6834fd8b1

Download Submit
memory/1852-7-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1852-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1852-14-0x0000000004F40000-0x000000000502F000-memory.dmp

Filesize
956KB

Download
memory/1852-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1852-27-0x000000000B9F0000-0x000000000BA93000-memory.dmp

Filesize
652KB

Download
memory/2980-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2980-6-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing