7e6a71d4114f88e1d601f7218de07176c2d79c6aef24996d0d9b24f012e39e43

General

Target

36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
Size

4.4MB
MD5

36b05b5575e0b5cf3ad1e5fc378175f0
SHA1

0671416378c8619e618c8b7f6eebc29409c35166
SHA256

7e6a71d4114f88e1d601f7218de07176c2d79c6aef24996d0d9b24f012e39e43
SHA512

851e1125f72a085f08f2fe23bdf2fe62bf2ed56a5c59c33a093da2f1fdd8289a153567d408dd79e80402ed9bcaa067fbfb3243f97f1ec3dd971ed64f932a490a
SSDEEP

98304:FWDUz94u+H0RFyYWuTEOd0XIyplGjvVAD8ocjIpPodLmpZ:oo7+kEupqXGjvVTHjpd

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\T:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\Z:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\D:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\J:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\L:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\Q:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\S:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\B:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\K:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\M:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\I:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\P:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\V:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\X:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\E:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\R:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\U:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\F:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\H:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\W:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\Y:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\G:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\A:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
File opened (read-only)	\??\O:	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
780	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
780	36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
56B

MD5
ca1fb4add2d3d0ff77cc28b4ff2fe8a6

SHA1
9f7643fcb09a3b3e9ae4b6765f1e6d17cd6b3c3b

SHA256
2fd0513a15986296cc9e60d963e613050eecf7ddb6e3751c44beb20b793ff0e9

SHA512
87679923e00ec41bf132718f9f32cd7e2103374bb2711468765ffeedcbadbfecf61021d1657578998fa010bee6be4f7579bfa36fda7aae3824ea8cabc621c549

Download Submit
C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
96B

MD5
c4daf67eabec4e1d9dbebb9588f06344

SHA1
48dee881f6504dac4ad6cc59c00f8c788b30e9f7

SHA256
60b229bca26f8bf70d1347e0e9a450e0a991dcc9051cb8496dfde682c20d23a5

SHA512
dc28eafd2ca9bb6d817d992df80d6ed74fb31567f361c4323d1d39dfcd864d7155397238a357c79372d64df175113cca0f6597f5492fc7b5b0cba04ffb7734f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
601B

MD5
e61130e6ba12983fa6165e6f2d462587

SHA1
7eedb63e800c0404e2b3a10bbda67b0db8f79484

SHA256
32b8f12bf5872d1abf76635f4a24ad57615b589b31d3cd360070402116b218d4

SHA512
e6f7f8889ddba658a6c3c657eb4f6b04a68a817ab078d71ee912ac87c2c84403c03040b7233b8d8a32bad2fbc0504a2a126ce94f636ced6f459285202b9fb276

Download Submit
C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

Filesize
36B

MD5
795c0ee5e9bdb35d6844f7898aaf75d2

SHA1
5609d819c7755020f10bd896590e16118ce92b02

SHA256
f9c70ebbc12852743b08d71afde13c5bc1fa18469212b184468345645880dc73

SHA512
ced8ba28a76fc904918965c0fa85ef9c05fa4958624418a7292f5baba7e6f24d891937f7e9b2d990d61172f40a4eae0149fe08bf2281ae453fe0f53ac213d899

Download Submit
memory/780-70-0x0000000005C30000-0x0000000005C31000-memory.dmp

Filesize
4KB

Download
memory/780-71-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/780-0-0x0000000000400000-0x0000000000FBB000-memory.dmp

Filesize
11.7MB

Download
memory/780-75-0x0000000005C90000-0x0000000005C91000-memory.dmp

Filesize
4KB

Download
memory/780-77-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

Filesize
4KB

Download
memory/780-76-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download
memory/780-74-0x0000000005C80000-0x0000000005C81000-memory.dmp

Filesize
4KB

Download
memory/780-73-0x0000000005C70000-0x0000000005C71000-memory.dmp

Filesize
4KB

Download
memory/780-72-0x0000000005C60000-0x0000000005C61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads