Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
dbd0a86dc45bf422b8343abe941223f0_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dbd0a86dc45bf422b8343abe941223f0_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
dbd0a86dc45bf422b8343abe941223f0_NEAS.exe
-
Size
57KB
-
MD5
dbd0a86dc45bf422b8343abe941223f0
-
SHA1
a0f9ebebeebf93d024aa4de6464cb7c8f947efaa
-
SHA256
6c907a964d8334d968f4460db8f9d5944348882e409a9caa2f8e75c0c6b6e25c
-
SHA512
76b0fd0447db613bd793745b0187a27d461486f8ff1dbd6ffdaec40044282c4e9941c0e84f2d4b174306778e091bc5e5e0114154084ec7371615400f15f1e0fe
-
SSDEEP
768:rCru/f9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRfLTWLReOOguz:fRTzy48untU8fOMEI3jyYfPDEOguz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2964 2956 dbd0a86dc45bf422b8343abe941223f0_NEAS.exe 29 PID 2956 wrote to memory of 2964 2956 dbd0a86dc45bf422b8343abe941223f0_NEAS.exe 29 PID 2956 wrote to memory of 2964 2956 dbd0a86dc45bf422b8343abe941223f0_NEAS.exe 29 PID 2956 wrote to memory of 2964 2956 dbd0a86dc45bf422b8343abe941223f0_NEAS.exe 29 PID 2964 wrote to memory of 1692 2964 cmd.exe 30 PID 2964 wrote to memory of 1692 2964 cmd.exe 30 PID 2964 wrote to memory of 1692 2964 cmd.exe 30 PID 2964 wrote to memory of 1692 2964 cmd.exe 30 PID 1692 wrote to memory of 2884 1692 iexpress.exe 31 PID 1692 wrote to memory of 2884 1692 iexpress.exe 31 PID 1692 wrote to memory of 2884 1692 iexpress.exe 31 PID 1692 wrote to memory of 2884 1692 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd0a86dc45bf422b8343abe941223f0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\dbd0a86dc45bf422b8343abe941223f0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1F63.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\dbd0a86dc45bf422b8343abe941223f0_NEAS.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2884
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
57KB
MD59771bde388f978412fff02c10e43d0c0
SHA1ee3fac46da98443bc810a156a78f8253d57fd66f
SHA256b6bf83a69e263c2cfa10f6143a40fed65ac35ff550519243db9699889e8ed9f8
SHA51282abec611a357e493901245f2d3ed02f69d53ec8efddb2f40fc4ea97a5310c06e06f222a029c98d7a2411c308a6668895e8916ac7bd7a8b41ade4ab17fcf9651
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083