ed9d2e59f7a7f9817f7f6737b905c87fc96ec6caae428c67060853937d4beea5

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

864477f714d0e1b524a18d80eb985490_NEAS.exe
Size

448KB
MD5

864477f714d0e1b524a18d80eb985490
SHA1

11ad11de7202170bbda8ef2d7a2cb40a8da4817f
SHA256

ed9d2e59f7a7f9817f7f6737b905c87fc96ec6caae428c67060853937d4beea5
SHA512

4fcf7699cc39e54b3c0e277efe5f3ef2d32cedf972f8e511b70aa02c992a2ce28ceaae02f59a875f4fc7d21ed65aef1e10631caa26c3b94e090ac82456c65084
SSDEEP

6144:4jlYKRF/LReWAsUywGIEWnsGZtuIjjvvaGXm0QXXLTJy1j1Uuwn:4jauDReWuvnsGfbzZQXXLTJy1j0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4996	vsyfx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\vsyfx.exe"	vsyfx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4996	8	864477f714d0e1b524a18d80eb985490_NEAS.exe	89
PID 8 wrote to memory of 4996	8	864477f714d0e1b524a18d80eb985490_NEAS.exe	89
PID 8 wrote to memory of 4996	8	864477f714d0e1b524a18d80eb985490_NEAS.exe	89

C:\Users\Admin\AppData\Local\Temp\864477f714d0e1b524a18d80eb985490_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\864477f714d0e1b524a18d80eb985490_NEAS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\ProgramData\vsyfx.exe
  "C:\ProgramData\vsyfx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DumpStack.log.tmp .exe

Filesize
448KB

MD5
1391a01dc43049e7e9d48d084ae4d561

SHA1
6d1a67d08b231056add72bd872bb6278c20a4480

SHA256
63a08b01cbe960ae655f5fff7edfff57a166a92b871a884133295250be88c90e

SHA512
49fbf80af4cffbe0c3bb709b47762e91e8c98d2a6ca9762926f0fc06fe0295b9cba720996f6e9af44c477ab95d855d27faa1fc5d70dd721070bea2b85f5ccf00

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\vsyfx.exe

Filesize
311KB

MD5
6381c212f25e28f4edf2759a0f5ad0d8

SHA1
4f19f321cefe11b88922b1c8482607ddc1949ddb

SHA256
06802246b970a840ca1d3338d520d48d5800890ae7d9238632aabf9fc6e5250c

SHA512
b7302561b21860e0b8af7fa4545488dd53a417b2baa82a8e4e99255b03264065a858fd7d65745522904b1a00bfec698bfc34ccb0a614001a618beddad59ce04e

Download Submit
memory/8-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/8-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/8-9-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4996-72-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads