Analysis

  • max time kernel
    142s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 08:16

General

  • Target

    059198935af7c5e3c0ae5080d10dc630_NEAS.exe

  • Size

    396KB

  • MD5

    059198935af7c5e3c0ae5080d10dc630

  • SHA1

    f464d2a21668a4310f93debb711f555044a79e0d

  • SHA256

    fe5406b43a014e3f51cbd6d28426f27db4566918637554a5e04b1b652ffb3797

  • SHA512

    74a9961001bbc4d5dd55b8ce67a1483651611e06e346467f8df495d990f8c8b61816caacb368c63764b6200493a060f229d9e0724d16ef03898698ed61ccb6de

  • SSDEEP

    12288:YEyTE+7JnTmf/GxrmHtqXoEWOujM67hEG3:C7dOoaHcoEhA

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\059198935af7c5e3c0ae5080d10dc630_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\059198935af7c5e3c0ae5080d10dc630_NEAS.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\059198935af7c5e3c0ae5080d10dc630_NEAS.exe
      C:\Users\Admin\AppData\Local\Temp\059198935af7c5e3c0ae5080d10dc630_NEAS.exe
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Users\Admin\AppData\Local\Temp\059198935af7c5e3c0ae5080d10dc630_NEAS.exe
        C:\Users\Admin\AppData\Local\Temp\059198935af7c5e3c0ae5080d10dc630_NEAS.exe
        3⤵
        • Modifies WinLogon for persistence
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram program = C:\Users\Admin\AppData\Roaming\lsass.exename = Nero mode = ENABLE
          4⤵
          • Modifies Windows Firewall
          PID:2728
        • C:\Users\Admin\AppData\Roaming\lsass.exe
          /d C:\Users\Admin\AppData\Local\Temp\059198935af7c5e3c0ae5080d10dc630_NEAS.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Users\Admin\AppData\Roaming\lsass.exe
            C:\Users\Admin\AppData\Roaming\lsass.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2612
            • C:\Users\Admin\AppData\Roaming\lsass.exe
              C:\Users\Admin\AppData\Roaming\lsass.exe
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetWindowsHookEx
              PID:2424

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Roaming\lsass.exe

          Filesize

          396KB

          MD5

          6241ff61a6ed5c8affb47e20cbb382c2

          SHA1

          8bcdf3be2e5079ec64b07dbb5fc8412357c94b9d

          SHA256

          a183c39c88aec94b95510739fbbd27742b2dbe80a8a40d7692485924024241d2

          SHA512

          aadc3b2e85e168560219fe2c391997876eb8c13b068e8737dc2155be7c1d2b633cde8f81a0ce43c38ac169b4d8d98610fd69fe2a8c07490f25c1b98fbb5d4709

        • memory/2424-89-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-84-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-80-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-88-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-87-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-86-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-85-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-90-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-91-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-83-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-82-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-81-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-78-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2424-79-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2552-13-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2552-45-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2552-27-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2552-11-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2552-15-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2612-77-0x0000000000400000-0x000000000044B000-memory.dmp

          Filesize

          300KB

        • memory/2612-56-0x0000000000400000-0x000000000044B000-memory.dmp

          Filesize

          300KB

        • memory/2812-26-0x0000000000400000-0x000000000044B000-memory.dmp

          Filesize

          300KB

        • memory/2812-6-0x0000000000400000-0x000000000044B000-memory.dmp

          Filesize

          300KB

        • memory/2812-2-0x0000000000400000-0x000000000044B000-memory.dmp

          Filesize

          300KB

        • memory/2812-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2812-8-0x0000000000400000-0x000000000044B000-memory.dmp

          Filesize

          300KB