Analysis
-
max time kernel
2s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 15:48
Static task
static1
Behavioral task
behavioral1
Sample
cfe49535d5614bead6b98f51a064bb90_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cfe49535d5614bead6b98f51a064bb90_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
cfe49535d5614bead6b98f51a064bb90_NEAS.exe
-
Size
112KB
-
MD5
cfe49535d5614bead6b98f51a064bb90
-
SHA1
d8741fee49ed44ef8ea0a84bcde1ffbb6efe689a
-
SHA256
d1d7b0e5a318fa830b20ba086db896bdd95b390329ab1781b8663c499b397e9e
-
SHA512
05fdfe07b6f492a9564ec6c3c48c9eb14e68d86b0bd3148791c0600070ed18a8f71e864f220c2e51adbe21096ff437729b6192c40a185e7adbc2cdcb090b34a4
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2360-124-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2360-118-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2360-115-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2360-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2360-109-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1984-277-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2360-281-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cfe49535d5614bead6b98f51a064bb90_NEAS.exedescription pid process target process PID 2188 set thread context of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 set thread context of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe 1904 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
cfe49535d5614bead6b98f51a064bb90_NEAS.execfe49535d5614bead6b98f51a064bb90_NEAS.exesvchost.exepid process 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe 2360 cfe49535d5614bead6b98f51a064bb90_NEAS.exe 1904 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cfe49535d5614bead6b98f51a064bb90_NEAS.exedescription pid process target process PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 1904 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe svchost.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe PID 2188 wrote to memory of 2360 2188 cfe49535d5614bead6b98f51a064bb90_NEAS.exe cfe49535d5614bead6b98f51a064bb90_NEAS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\cfe49535d5614bead6b98f51a064bb90_NEAS.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XBYMY.bat" "3⤵PID:1848
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵PID:1644
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵PID:2780
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:832
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵PID:2016
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵PID:1984
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD5cae42607cee55c34b27b8069520ef9e5
SHA1ea0f869ba8490d836d0756f6355253e15923d18a
SHA25617ec7c908f50fb3f567572cdce27fce7ef12a893b3284d8e46cdf42ce5ed3d92
SHA5125da6f58a9d81c693636134029cba977c468a96db19a92278852e69651a78154c3163ee049104ce5c4204c4819e47e0d104deffdb388f936b86ae2d07a41b0f77