Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07/05/2024, 15:13
General
-
Target
c6302e28b98ef3764ceb8b72966b3bc0_NEAS.exe
-
Size
203KB
-
MD5
c6302e28b98ef3764ceb8b72966b3bc0
-
SHA1
cb393a5687ae274e18cd194fb6799e232eae3c46
-
SHA256
1ecc1729dbb7fd5891e50801d74a952a6b13351cf333d2b8eb201361a169a39c
-
SHA512
4b66b91ac0940964779392749cd283250638e339f4e92dd196f2fb919c30034fac0dec80764597a555bb57da94d4bb0e5a92c089b77238eeba6d4932dac76771
-
SSDEEP
3072:1x1SkE2C32N5YrBTNoNWvMWSSNHhTghRndmWQMa886if19MJt4lEJGMsget:skS32nYFTNoNWvMJcHcRnYN88pwsZ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6302e28b98ef3764ceb8b72966b3bc0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\c6302e28b98ef3764ceb8b72966b3bc0_NEAS.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c6302e28b98ef3764ceb8b72966b3bc0_NEAS.exeC:\Users\Admin\AppData\Local\Temp\c6302e28b98ef3764ceb8b72966b3bc0_NEAS.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
203KB
MD5e575f7887894a91908b294bfa2d44809
SHA1cf331109ef0e95423f7ab4f435436d8ed68506dd
SHA256939fdfdae6e9a991c5f5c581989bf47ae8481bb672ce3d7692906c805eda5896
SHA51241c5d6e7f5e867b2453ebf575d7508a75b32bb74c16925f219beb4a93305b0515317b45b31df30f41b8d4749a3520cb223c357c70767a646953933dea27c5699
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
84KB
-
Filesize
248KB
-
Filesize
248KB