Analysis
-
max time kernel
93s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 13:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe
-
Size
1.1MB
-
MD5
ebbcae8a6ac0cababc732d3054eaa32c
-
SHA1
00504e8b0c9f34fd5d7e86ef0f1a784c41154c8a
-
SHA256
de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9
-
SHA512
0cc25a6dc7290abad490f010bc655fd554504956c666f1617b9a3f9dfe52c95e957b0bebf71aacaee97d36c33ecac5ac3ba1f1defe59819056aba36e8e62dd09
-
SSDEEP
24576:WfmMv6Ckr7Mny5QLg4iMM14ZBPNyK/zoJY6B0rY:W3v+7/5QL1XM2ZBPNlYEY
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neophobia.vbs neophobia.exe -
Executes dropped EXE 1 IoCs
pid Process 3360 neophobia.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023cb8-5.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1388 3360 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neophobia.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe 3360 neophobia.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3360 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 96 PID 2040 wrote to memory of 3360 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 96 PID 2040 wrote to memory of 3360 2040 de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe 96 PID 3360 wrote to memory of 4072 3360 neophobia.exe 97 PID 3360 wrote to memory of 4072 3360 neophobia.exe 97 PID 3360 wrote to memory of 4072 3360 neophobia.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe"C:\Users\Admin\AppData\Local\Temp\de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\emboweling\neophobia.exe"C:\Users\Admin\AppData\Local\Temp\de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9.exe"3⤵PID:4072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 7523⤵
- Program crash
PID:1388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3360 -ip 33601⤵PID:4848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5ebbcae8a6ac0cababc732d3054eaa32c
SHA100504e8b0c9f34fd5d7e86ef0f1a784c41154c8a
SHA256de2b53ae95672d4811a3203e495104c8aa37da17159b3e7b7486f44d6ade60a9
SHA5120cc25a6dc7290abad490f010bc655fd554504956c666f1617b9a3f9dfe52c95e957b0bebf71aacaee97d36c33ecac5ac3ba1f1defe59819056aba36e8e62dd09