Analysis
- max time kernel
2s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
07/05/2024, 15:48
General
- Target cfe49535d5614bead6b98f51a064bb90_NEAS.exe
- Size 112KB
- Sample240507-s8395ade6y
- SHA256 d1d7b0e5a318fa830b20ba086db896bdd95b390329ab1781b8663c499b397e9e
Malware Config
Signatures
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XBYMY.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
XBYMY.bat
WAMain.exe
memory/1904-89-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1904-106-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1904-116-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1904-119-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1984-277-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2188-32-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/2188-38-0x00000000003F0000-0x00000000003F2000-memory.dmp
memory/2188-63-0x0000000000440000-0x0000000000442000-memory.dmp
memory/2188-80-0x0000000000480000-0x0000000000481000-memory.dmp
memory/2188-88-0x00000000004A0000-0x00000000004A2000-memory.dmp
memory/2188-28-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/2188-8-0x00000000002F0000-0x00000000002F1000-memory.dmp
memory/2188-4-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2188-2-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2188-61-0x0000000000430000-0x0000000000432000-memory.dmp
memory/2188-14-0x0000000000310000-0x0000000000311000-memory.dmp
memory/2188-20-0x0000000000370000-0x0000000000371000-memory.dmp
memory/2360-111-0x0000000000400000-0x000000000040B000-memory.dmp
memory/2360-109-0x0000000000400000-0x000000000040B000-memory.dmp
memory/2360-107-0x0000000000400000-0x000000000040B000-memory.dmp
memory/2360-113-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2360-115-0x0000000000400000-0x000000000040B000-memory.dmp
memory/2360-118-0x0000000000400000-0x000000000040B000-memory.dmp
memory/2360-124-0x0000000000400000-0x000000000040B000-memory.dmp
memory/2360-281-0x0000000000400000-0x000000000040B000-memory.dmp