98b66cd9136f741eef5ab4f3953b3ae360ee442d9e125a82c1d9fd24fad8ace3 | Triage

Analysis

max time kernel
6s
max time network
9s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 13:36

Sharing

Report Analysis Logs

General

Target

neo.exe
Size

6.6MB
MD5

0cc6f55c76921b1203f0959f535db957
SHA1

6ffca576f55e053e1613371fe7efe620a367551e
SHA256

98b66cd9136f741eef5ab4f3953b3ae360ee442d9e125a82c1d9fd24fad8ace3
SHA512

74bee84563863d1ce6514ab171c658ef3c43b56f14a7546196431199e5ba14f6819ef8104e4314e3b5c53a18b9198bc40e0c7a03f04cd579114c96e9bd3b560f
SSDEEP

196608:jSP6CsXDjDyfEEEbnaAo00ViavGO8RENVBF8X:5CEDDpbnx0VtvG5RENVBF8X

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

neo.exe

pid process

2608 neo.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

neo.exe

description	pid	process	target process
PID 2072 wrote to memory of 2608	2072	neo.exe	neo.exe
PID 2072 wrote to memory of 2608	2072	neo.exe	neo.exe
PID 2072 wrote to memory of 2608	2072	neo.exe	neo.exe

C:\Users\Admin\AppData\Local\Temp\neo.exe
"C:\Users\Admin\AppData\Local\Temp\neo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\neo.exe
"C:\Users\Admin\AppData\Local\Temp\neo.exe"
2⤵
- Loads dropped DLL
PID:2608

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20722\python310.dll
Filesize
4.2MB

MD5
55a168d16ea25dc629501a10b23a886b

SHA1
1c58caa6eeb7c06acdd407fe5975861abad852e9

SHA256
379dc437c778bfa2a3afc7a9809195e998af22ccb4f3a1333a48ccb8e3ff0a22

SHA512
d2638310806afe9b0125410cd59106cfda0546f03c06510e08b6c79535ac830787f55c2784051c94a70205731f7411494a38f08eec8b1987f61b81b964a1bca5

Download Submit