e8012b90237dbc94f6d700a4d825edc7167e8316fdbd86c238e28ec91160e6e0

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee778fad5682d44dc4089141def97600_NEAS.exe
Size

4.1MB
MD5

ee778fad5682d44dc4089141def97600
SHA1

95ea68fb455dc7ad34c2dcf1cb59e8db727666ad
SHA256

e8012b90237dbc94f6d700a4d825edc7167e8316fdbd86c238e28ec91160e6e0
SHA512

c2c07dcb7b04fc02fc27e86375595bf2652e41bf011fbd7cbdfc4c2a3f4fd72beb7d82374b7614bba7011c928f1aa7d9a5f7d251da7d7ea295176c2b2f545070
SSDEEP

98304:+R0pI/IQlUoMPdmpSpq4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmR5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1944	devoptisys.exe

Loads dropped DLL 1 IoCs

pid	Process
2796	ee778fad5682d44dc4089141def97600_NEAS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeRP\\devoptisys.exe"	ee778fad5682d44dc4089141def97600_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxHQ\\optixloc.exe"	ee778fad5682d44dc4089141def97600_NEAS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe
1944	devoptisys.exe
2796	ee778fad5682d44dc4089141def97600_NEAS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1944	2796	ee778fad5682d44dc4089141def97600_NEAS.exe	28
PID 2796 wrote to memory of 1944	2796	ee778fad5682d44dc4089141def97600_NEAS.exe	28
PID 2796 wrote to memory of 1944	2796	ee778fad5682d44dc4089141def97600_NEAS.exe	28
PID 2796 wrote to memory of 1944	2796	ee778fad5682d44dc4089141def97600_NEAS.exe	28

C:\Users\Admin\AppData\Local\Temp\ee778fad5682d44dc4089141def97600_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\ee778fad5682d44dc4089141def97600_NEAS.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2796
- C:\AdobeRP\devoptisys.exe
  C:\AdobeRP\devoptisys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxHQ\optixloc.exe

Filesize
4.1MB

MD5
ffebc0b3ce5b41591522cf9550ce545a

SHA1
607260604e8d3334b8b013f5dba279f4f83691b4

SHA256
a56f13c3e9e7328232d3cf8244f3903d5c0d9b507d19edbeecaa770b0e8cd88d

SHA512
75da5ac36918f99ecc49463aad71a4768c1555bee686cad5d7da4687f224b37f2f0ad6c52d24c89df7fb3e1e11ff18e3dfe36c494bab42083017cb48c8257605

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
9ce548c7ac1707097560fceffeda7de0

SHA1
90b9ab1c9c4061c50dce50bf33c00166e4655550

SHA256
87aa2a4b6b5db1f1d78409970631ffc87806972af0c07320c790ee8d70816918

SHA512
55f9a318bb798f89478c39e17458e1b055e6ffb47722fd1ff88af701ee41fdbe60b5c5934de7f1deb4434f8ba7b29d9607fcd2353216567498121f9e035ea901

Download Submit
\AdobeRP\devoptisys.exe

Filesize
4.1MB

MD5
0f027c733857bef5e98d71cceacd1a06

SHA1
a339d924dfb1a3f0e032a5c4d7ec23a5ef342b18

SHA256
d3959c118960cab2510194ef4ef157463e53d76c1595ff7766feaa009d3e210a

SHA512
b8e98a3ac4d4b31c7c857559c2f7392617faa44d8ff90f603ee7f4bdb16ae4d33086f226038d49c859bf9e90a546d9bc180bfa8e845de29902931f84a48e6d9e

Download Submit