6f11a9a21940da807d5680298539503bf1829ec96dda1355ffb719b2f631bcde

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
183bdf48a8a9d53bfc8b311739377670_NEAS.exe
Size 591KB
Sample240507-kyd89acc56
SHA256 6f11a9a21940da807d5680298539503bf1829ec96dda1355ffb719b2f631bcde
MD5 183bdf48a8a9d53bfc8b311739377670
SHA1 62c40790873bf0833613136eb54949b5c0d62458
SHA512 e2212c3d27cf2704678db65923c13e81501bbcafe83388ba67f57eb124551aa82709ca9b9565cc4842aefa184aff58fd11255d506e8085e89233a7d551821fdc
SSDEEP 12288:VGbZFT9o+WkcS9SQcCyfi0npM4dl0v5Jdm5IpXt1Up0:UT97jD9QCyfiEM4dmv5BJtOp0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4116	183bdf48a8a9d53bfc8b311739377670_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
4116	183bdf48a8a9d53bfc8b311739377670_NEAS.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4880	2116	WerFault.exe	81
3120	4116	WerFault.exe	88
4048	4116	WerFault.exe	88
664	4116	WerFault.exe	88
3032	4116	WerFault.exe	88
4368	4116	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2116	183bdf48a8a9d53bfc8b311739377670_NEAS.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4116	183bdf48a8a9d53bfc8b311739377670_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4116	2116	183bdf48a8a9d53bfc8b311739377670_NEAS.exe	88
PID 2116 wrote to memory of 4116	2116	183bdf48a8a9d53bfc8b311739377670_NEAS.exe	88
PID 2116 wrote to memory of 4116	2116	183bdf48a8a9d53bfc8b311739377670_NEAS.exe	88

C:\Users\Admin\AppData\Local\Temp\183bdf48a8a9d53bfc8b311739377670_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\183bdf48a8a9d53bfc8b311739377670_NEAS.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 384
  2⤵
  - Program crash
  PID:4880
- C:\Users\Admin\AppData\Local\Temp\183bdf48a8a9d53bfc8b311739377670_NEAS.exe
  C:\Users\Admin\AppData\Local\Temp\183bdf48a8a9d53bfc8b311739377670_NEAS.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 352
    3⤵
    - Program crash
    PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 772
    3⤵
    - Program crash
    PID:4048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 776
    3⤵
    - Program crash
    PID:664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 796
    3⤵
    - Program crash
    PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 780
    3⤵
    - Program crash
    PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2116 -ip 2116
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4116 -ip 4116
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4116 -ip 4116
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4116 -ip 4116
1⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4116 -ip 4116
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4116 -ip 4116
1⤵
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

183bdf48a8a9d53bfc8b311739377670_NEAS.exe

Path C:\Users\Admin\AppData\Local\Temp\183bdf48a8a9d53bfc8b311739377670_NEAS.exe
Size 591KB
SHA256 0e8220d7a1d9b6c0bed09dc3986d1da994a75c2949fe06fc7ae412b28be33055
MD5 1567b5eb96779b25a2f80f21981241c0
SHA1 0969ebe6b0047607f2bc8779e14914f8145d2ef7
SHA512 ca4ab6b6e67b708960ca412d12ab2c28a8be2d98d66414d432cc279c2735f2b54730b1a0ec76a2aa08b91d05f912a328988a82735abebef5629be092b26f6eb9
SSDEEP 12288:T3zSPS2YOk6a7DrCyfi0npM4dl0v5Jdm5IpXt1Up0:Tj2S2HkDfrCyfiEM4dmv5BJtOp0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2116-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2116-6-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4116-7-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4116-8-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4116-13-0x00007FFDA25B0000-0x00007FFDA27A5000-memory.dmp

Download

memory/4116-14-0x0000000000400000-0x000000000043F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads