Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 07:55
Behavioral task
behavioral1
Sample
98d5b874580ebdd8e6070777907e8180_NEAS.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
98d5b874580ebdd8e6070777907e8180_NEAS.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
98d5b874580ebdd8e6070777907e8180_NEAS.exe
-
Size
267KB
-
MD5
98d5b874580ebdd8e6070777907e8180
-
SHA1
f57e2093d456940bcca09bc43504367aee51e666
-
SHA256
8b781d9b719b80b977421d3f319ad0a926fbb07c110b326402a9ff6c831effc2
-
SHA512
f9ddbfe8fc2d3e9d7e4659e0f5c0a0e3f17a8c53a877955f3ffc8400b222b36c4bbee5152de15b68f5b0097e07e5e1c378ffd25c8827fca7c477a5d703801cb4
-
SSDEEP
6144:JmCAIuZAIuDMVtM/1H0WH0t9UpK7ShcHUaZH:7AIuZAIuOQH0WH07vUax
Score
9/10
Malware Config
Signatures
-
Renames multiple (4880) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 724 Zombie.exe -
resource yara_rule behavioral2/memory/2812-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b59-5.dat upx behavioral2/files/0x000a000000023bb9-10.dat upx behavioral2/memory/2812-12-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 98d5b874580ebdd8e6070777907e8180_NEAS.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 98d5b874580ebdd8e6070777907e8180_NEAS.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2812 wrote to memory of 724 2812 98d5b874580ebdd8e6070777907e8180_NEAS.exe 84 PID 2812 wrote to memory of 724 2812 98d5b874580ebdd8e6070777907e8180_NEAS.exe 84 PID 2812 wrote to memory of 724 2812 98d5b874580ebdd8e6070777907e8180_NEAS.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\98d5b874580ebdd8e6070777907e8180_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\98d5b874580ebdd8e6070777907e8180_NEAS.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:724
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD58bda1fe3a764ccdf2b35fa999c3c97dc
SHA19ad4ea165e34cc724dfbdf535d8aad8e360bee1a
SHA256c62b41dc3cb2180bbfbd80292ab1a03682dcdf86f2075511abf6c2051bfeadef
SHA5125cd1e3028b3180996601ea5eb455db79da20d87e85e2999eed822da70a17a5d21aab59e1e0933209463b79e12a42dfc0e6ff21e5a8ef164aad981aa8f4c016fd
-
Filesize
123KB
MD52b49026c8f3ab3643306c29494dd1c97
SHA161f40bcf06f928fe41a6df626585e2ab0b1f503c
SHA2567e290397a053c8f15e76851427b840a1766eb8c7541e3c33de82afbd58fd1c98
SHA51282770b8547ec8670758a5216ee6fb4b4c509d54ea1c4702b218fd9b1af38bae4d47f1b4da8f1576b24c6890667d0b9770f2d19d58f8bd4042d6694325e724d1b