7e6a71d4114f88e1d601f7218de07176c2d79c6aef24996d0d9b24f012e39e43

General

Target

36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
Size

4.4MB
MD5

36b05b5575e0b5cf3ad1e5fc378175f0
SHA1

0671416378c8619e618c8b7f6eebc29409c35166
SHA256

7e6a71d4114f88e1d601f7218de07176c2d79c6aef24996d0d9b24f012e39e43
SHA512

851e1125f72a085f08f2fe23bdf2fe62bf2ed56a5c59c33a093da2f1fdd8289a153567d408dd79e80402ed9bcaa067fbfb3243f97f1ec3dd971ed64f932a490a
SSDEEP

98304:FWDUz94u+H0RFyYWuTEOd0XIyplGjvVAD8ocjIpPodLmpZ:oo7+kEupqXGjvVTHjpd

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\R:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\W:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\Z:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\L:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\Y:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\T:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\U:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\X:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\F:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\B:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\G:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\I:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\V:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\H:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\J:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\K:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\D:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\M:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\N:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\P:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\S:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\A:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\O:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\Q:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2360	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
2360	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
56B

MD5
ca1fb4add2d3d0ff77cc28b4ff2fe8a6

SHA1
9f7643fcb09a3b3e9ae4b6765f1e6d17cd6b3c3b

SHA256
2fd0513a15986296cc9e60d963e613050eecf7ddb6e3751c44beb20b793ff0e9

SHA512
87679923e00ec41bf132718f9f32cd7e2103374bb2711468765ffeedcbadbfecf61021d1657578998fa010bee6be4f7579bfa36fda7aae3824ea8cabc621c549

Download Submit
C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
96B

MD5
c4daf67eabec4e1d9dbebb9588f06344

SHA1
48dee881f6504dac4ad6cc59c00f8c788b30e9f7

SHA256
60b229bca26f8bf70d1347e0e9a450e0a991dcc9051cb8496dfde682c20d23a5

SHA512
dc28eafd2ca9bb6d817d992df80d6ed74fb31567f361c4323d1d39dfcd864d7155397238a357c79372d64df175113cca0f6597f5492fc7b5b0cba04ffb7734f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
510B

MD5
558a629bad5b8c71d8bd79fade034794

SHA1
ad6153864f775b04cea448e657bcae1331249b44

SHA256
fb14e7665c13ecf1de00cf2b5464d3aa005fecca9d382ffb11f975ebb27faa70

SHA512
ffbf0bdf792c7dfca67ebe3422d3d386db72e8de25502d56080c7e072b520df0adddc826a0fcd83496a0316a55a1dac814a582917b888168ddbf88e862318963

Download Submit
C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
36B

MD5
795c0ee5e9bdb35d6844f7898aaf75d2

SHA1
5609d819c7755020f10bd896590e16118ce92b02

SHA256
f9c70ebbc12852743b08d71afde13c5bc1fa18469212b184468345645880dc73

SHA512
ced8ba28a76fc904918965c0fa85ef9c05fa4958624418a7292f5baba7e6f24d891937f7e9b2d990d61172f40a4eae0149fe08bf2281ae453fe0f53ac213d899

Download Submit
memory/2360-74-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/2360-75-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/2360-0-0x0000000000400000-0x0000000000FBB000-memory.dmp

Filesize
11.7MB

Download
memory/2360-73-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/2360-72-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/2360-71-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/2360-70-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/2360-80-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/2360-79-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads