Analysis
- user interaction
yes - max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/09/2026, 12:19
Behavioral task
behavioral1
Sample
NeatVideo for Resolve v6.0.0 CE.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target NeatVideo for Resolve v6.0.0 CE.exe
- Size 21.1MB
- Sample260909-pg778aca33
- SHA256 2e0feb2b823afea247b621c6f95efa10b569404bf6af704646e07df6baf3619d
- MD5 9a903e923994351faf387b081427a820
- SHA1 37edecde8b3314cc33887686c34ae72a67686000
- SHA512 0da9147a8b19b808e32aec921b401ac043d167459494064884ed8b03de351cf28c746b48a03436e122d9006437603afd9996931af81f1ca4bd39c9e42e2e8d77
- SSDEEP 393216:GFrElSlHsnWIPiYdxyHO2Y/nAUCz24Gj5PxK9o8+evIgKG0jdFM9Lp+b:2rlMn3Pxp8z2rj5CMaCd29t+b
- TLSH T1D427336BB29E203DD45A66355AB7D150993B7F2679328D2E52F0390CCF224484F3FAB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 724 NeatVideo for Resolve v6.0.0 CE.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 50 IoCs
description ioc Process File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\General\is-6MSJK.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Unnatural residual noise\is-MUCEI.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created C:\Program Files\Common Files\OFX\Plugins\NeatVideo6RS.ofx.bundle\Contents\Resources\is-P5QVT.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\LINKS\is-HEJ5B.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\LINKS\is-D71UQ.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\LINKS\is-6FG2F.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Flicker in video\is-NEF8E.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\General\is-UP7MI.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\In-camera noise reduction\is-2ON1Q.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Dust and scratches\is-MAMLB.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\LINKS\is-V8H97.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\LINKS\is-VPVM2.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Jitter of fine details in video\is-Q5QN2.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Strong color noise\is-VFVF2.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Noise changes in time\is-G7TSJ.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Slow shutter (camera in night mode)\is-3NJOI.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\is-T6KHS.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\is-B8K1O.tmp NeatVideo for Resolve v6.0.0 CE.tmp File opened for modification C:\Program Files\Common Files\OFX\Plugins\NeatVideo6RS.ofx.bundle NeatVideo for Resolve v6.0.0 CE.tmp File created C:\Program Files\Common Files\OFX\Plugins\NeatVideo6RS.ofx.bundle\is-GB77M.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Unnatural residual noise\is-DI5DE.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Unnatural residual noise\is-Q080I.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\General\is-2EJFP.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Slow shutter (camera in night mode)\is-HDDSR.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Banding in processed video\is-KQP1J.tmp NeatVideo for Resolve v6.0.0 CE.tmp File opened for modification \??\c:\Program Files\Neat Video v6 for Resolve\unins000.dat NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\is-SRMHO.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Jitter of fine details in video\is-3HMQP.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Flicker in video\is-RCR9R.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\In-camera noise reduction\is-LH9DH.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Banding in processed video\is-LNI2A.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Out-of-focus video\is-OALB3.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\In-camera noise reduction\is-QTJ7K.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\NeatVideo6RS.ofx.bundle\Contents\Win64\is-7QBC9.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created C:\Program Files\Common Files\OFX\Plugins\NeatVideo6RS.ofx.bundle\is-8AOPJ.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Dust and scratches\is-US0SU.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Dust and scratches\is-1GJKE.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Slow shutter (camera in night mode)\is-SERDE.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\is-50PTR.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\NeatVideo6RS.ofx.bundle\Contents\Resources\is-F91TH.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\is-K69OQ.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\LINKS\is-TMGDK.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\unins000.dat NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Ultra low frequency noise\is-NMK7J.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Flicker in video\is-2DAJN.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\General\is-UV7E6.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\General\is-N7IBN.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Out-of-focus video\is-LI419.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created \??\c:\Program Files\Neat Video v6 for Resolve\PRESETS\Advanced\Strong color noise\is-B2CNB.tmp NeatVideo for Resolve v6.0.0 CE.tmp File created C:\Program Files\Common Files\OFX\Plugins\NeatVideo6RS.ofx.bundle\Contents\Win64\is-N2AD1.tmp NeatVideo for Resolve v6.0.0 CE.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NeatVideo for Resolve v6.0.0 CE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NeatVideo for Resolve v6.0.0 CE.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/816-0-0x0000000000400000-0x00000000004FD000-memory.dmp innosetup behavioral1/memory/816-7-0x0000000000400000-0x00000000004FD000-memory.dmp innosetup behavioral1/memory/816-140-0x0000000000400000-0x00000000004FD000-memory.dmp innosetup - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 724 NeatVideo for Resolve v6.0.0 CE.tmp - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 816 wrote to memory of 724 816 NeatVideo for Resolve v6.0.0 CE.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\NeatVideo for Resolve v6.0.0 CE.exe"C:\Users\Admin\AppData\Local\Temp\NeatVideo for Resolve v6.0.0 CE.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\is-DST52.tmp\NeatVideo for Resolve v6.0.0 CE.tmp"C:\Users\Admin\AppData\Local\Temp\is-DST52.tmp\NeatVideo for Resolve v6.0.0 CE.tmp" /SL5="$90232,20931516,976384,C:\Users\Admin\AppData\Local\Temp\NeatVideo for Resolve v6.0.0 CE.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:724
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-DST52.tmp\NeatVideo for Resolve v6.0.0 CE.tmp
- Size 3.5MB
- SHA256 864591782aa6970d6f076a747ab727189c36c9ffc9ebf2e86eb0ce355552121b
- MD5 de9e8229f7bef19d85d25ab285979f2a
- SHA1 898687cde3758640db1833e57ef0d0057e28ba93
- SHA512 07dc43ab5a639c1649a61759490eb6961808c65265e6f5da4a5bf7bcae1b58acb948df37d7948f1e5e99d28a534a352d6a6f75ddf9c484d12c43cef794b10a06
- SSDEEP 49152:f1zRq2Y18BiBThOSM28vFIA5IGCFv4RMhfJgwTkl333A:NzRi3dGCFW+fJ6333A
- TLSH T1E9066C17F384713EC05B2A324937C694993B7B246A269D67A7FC394C8F39140AE3B746
- MD5 SHA1 SHA512 SSDEEP TLSH