7eb5bc82cf707f1397cd3fcd2ae112356836e0c996c16b79bfe60f561192b167

General

Target

74e81b54a7d03c8725673906498c5cb0_NEAS.exe
Size

2.0MB
MD5

74e81b54a7d03c8725673906498c5cb0
SHA1

4de7d8ed3e1cfb6d4b65551d752c9403ff22c7db
SHA256

7eb5bc82cf707f1397cd3fcd2ae112356836e0c996c16b79bfe60f561192b167
SHA512

266631f953599541e4c90891ac3dc8727d5e52ef377e6a0aeb244852f34e99b47e9ee91f61229edb83123aad47b68e29f0673c392d4672afcdfa366e83e50b91
SSDEEP

49152:OFUcx88PWPOpX0SFK2oYR00PYWMCtKGNZBNczKCl8yGc:O+K88uPCHf00P/MoKGFNuF8yGc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1240	1D8F.tmp

Loads dropped DLL 1 IoCs

pid	Process
2156	74e81b54a7d03c8725673906498c5cb0_NEAS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2260	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1240	1D8F.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	WINWORD.EXE
2260	WINWORD.EXE
2260	WINWORD.EXE
2260	WINWORD.EXE
2260	WINWORD.EXE
2260	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1240	2156	74e81b54a7d03c8725673906498c5cb0_NEAS.exe	28
PID 2156 wrote to memory of 1240	2156	74e81b54a7d03c8725673906498c5cb0_NEAS.exe	28
PID 2156 wrote to memory of 1240	2156	74e81b54a7d03c8725673906498c5cb0_NEAS.exe	28
PID 2156 wrote to memory of 1240	2156	74e81b54a7d03c8725673906498c5cb0_NEAS.exe	28
PID 1240 wrote to memory of 2260	1240	1D8F.tmp	29
PID 1240 wrote to memory of 2260	1240	1D8F.tmp	29
PID 1240 wrote to memory of 2260	1240	1D8F.tmp	29
PID 1240 wrote to memory of 2260	1240	1D8F.tmp	29

C:\Users\Admin\AppData\Local\Temp\74e81b54a7d03c8725673906498c5cb0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\74e81b54a7d03c8725673906498c5cb0_NEAS.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\1D8F.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D8F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\74e81b54a7d03c8725673906498c5cb0_NEAS.exe 337AFEE32BD84BDDD6F020F48B0C0BB1218EB5BF12060E8EFF1DC20A557CFF597B69D1EBDFEB2B6138BD4196ECBE035E3E5E9E796309C1E77621AF5DA2EA1011
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74e81b54a7d03c8725673906498c5cb0_NEAS.docx"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1D8F.tmp

Filesize
2.0MB

MD5
0fdb6232f9b8254194a82f98694558cf

SHA1
79dbbe0058c7ee27f0e391f40c1380fed97917f2

SHA256
90b1614e9f3401f0b2c976c6d3e99dd0cef9b4b64a859e6023d6104433ee0541

SHA512
2b9eb1ad3a76ba2e4726f576ae90cf970cb635585d93dc7f66e5628c5d09f04ccce147d934ec111bd662f4f2db3e5e1f474e6c27be935aa30527e1f7c31ef152

Download Submit
C:\Users\Admin\AppData\Local\Temp\74e81b54a7d03c8725673906498c5cb0_NEAS.docx

Filesize
19KB

MD5
4046ff080673cffac6529512b8d3bdbb

SHA1
d3cbc39065b7a55e995fa25397da2140bdac80c1

SHA256
f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680

SHA512
453f70730b7560e3d3e23ddfa0fe74e014753f8b34b45254c1c0cf5fec0546a2b8b109a4f9d096e91711b6d02cb383a7136c2cb7bd6600d0598acf7c90c25418

Download Submit
memory/1240-6-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/2156-0-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/2260-9-0x000000002F551000-0x000000002F552000-memory.dmp

Filesize
4KB

Download
memory/2260-10-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2260-11-0x0000000071A7D000-0x0000000071A88000-memory.dmp

Filesize
44KB

Download
memory/2260-15-0x0000000071A7D000-0x0000000071A88000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing