a1790f5638a1b69236e184a1edbd3703e3234a0d933e85f681c35df0e1e4ccbc

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
Size

2.7MB
MD5

8e4e7aee7656cada75436e6d2af4d820
SHA1

5281c3fbe362344fa2917069990dd616a876706d
SHA256

a1790f5638a1b69236e184a1edbd3703e3234a0d933e85f681c35df0e1e4ccbc
SHA512

09955bda9a8645e46aca415a924b9852f439bd920c441197447d04833ce35f91dc2379834400d7815adb6308e25a60393a5302e57b68bf01d01ecd582efc5558
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBb9w4Sx:+R0pI/IQlUoMPdmpSpn4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4284	adobsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotUG\\adobsys.exe"	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxXO\\optixloc.exe"	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
4284	adobsys.exe
4284	adobsys.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4284	5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe	89
PID 5032 wrote to memory of 4284	5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe	89
PID 5032 wrote to memory of 4284	5032	8e4e7aee7656cada75436e6d2af4d820_NEAS.exe	89

C:\Users\Admin\AppData\Local\Temp\8e4e7aee7656cada75436e6d2af4d820_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\8e4e7aee7656cada75436e6d2af4d820_NEAS.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5032
- C:\UserDotUG\adobsys.exe
  C:\UserDotUG\adobsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxXO\optixloc.exe

Filesize
1.4MB

MD5
d79efee50bce4e4901c06f8b4d574f3e

SHA1
e60d86e3af9d06c99364050d2fc943e9b74b4835

SHA256
6436ca7379f73c8f9fbbae9e3df4b778608e471f90763b73e3073abdebf76878

SHA512
fe0701310a9ee038f8070d6a653898c462b0144f2f15d08ece837343cc501721926438fe91285203e524555a7d674a67a536a17bc1adace316a4c612528d0d5f

Download Submit
C:\GalaxXO\optixloc.exe

Filesize
2.7MB

MD5
e01573a11ac282e597c69050be43065d

SHA1
80d5b3afa7a6b3c277ffa2442f20aa7e12dce1f6

SHA256
f2c27ff269f3cb64190e4cc39d3b499095f23528e8da77a412f1a7e4d992311b

SHA512
64b465d30e2d9b1eb7c3d87574690e0436d53310fccf344fe4cf13cc716d75c16d7282a7f0fd02788facea477db1b0cb6aee5ba0c2cb1ad1bd7dc83e6da7efe1

Download Submit
C:\UserDotUG\adobsys.exe

Filesize
2.7MB

MD5
f5eebeb8e3614f811db689468ef0b82f

SHA1
1ca5edad3b81100f5721c677c0200d78ef6e5b3f

SHA256
6c2ca5b36466326f1a650c0910616b6c2fb3c4c0c637096ed669d6053a067c87

SHA512
8069a573d7b36f3ff001eb0d253f8553ca22b7e6f3e60f37eb9d136dd56bdaea2b26b2da398f4d825c5f369baf03e97612a8f3993bfa91d82cc47ec3b605e0b9

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
e2b4babcd39c628f0ed907df6502c41a

SHA1
4b8b87250b13efb28cb9d12d330e0f5056be03cf

SHA256
32e9ea46d1612f3ee09b120021755b767a386d05afc0a6b4ddbd43fb2de91457

SHA512
51b411efea722de30ca1a62e730417f7f76b28da9476459816e27cd4b7b89c3ad9f9ddd39a471fbd8de1778a2378d4daa3071493427cc6b0d46586c15e4a2152

Download Submit