3a7ce9c2729308e680c439e4032c63ff32d83f6d66ab2528d2fadb8ca7f08274

General

Target

b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093.exe
Size

1.8MB
MD5

7678217358637f0e5f06128dfdc7b3e4
SHA1

0867c058cdcf861deacde7ea2fcd2b589729a3b6
SHA256

b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093
SHA512

9880f2635237f22ee1da10bd766ebc9df28e73a5ff63191c5c5cd48f6f4ce13be96de0ce03cfdfe0307746258e739102a7aaf1a40d3719099832c5b5fdb770e6

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1356	Neghi.exe.com
412	Neghi.exe.com

Loads dropped DLL 2 IoCs

pid	Process
1288	cmd.exe
1356	Neghi.exe.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Neghi.exe.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Neghi.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1632	PING.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2032	1684	b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093.exe	29
PID 1684 wrote to memory of 2032	1684	b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093.exe	29
PID 1684 wrote to memory of 2032	1684	b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093.exe	29
PID 1684 wrote to memory of 2032	1684	b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093.exe	29
PID 2032 wrote to memory of 1288	2032	cmd.exe	31
PID 2032 wrote to memory of 1288	2032	cmd.exe	31
PID 2032 wrote to memory of 1288	2032	cmd.exe	31
PID 2032 wrote to memory of 1288	2032	cmd.exe	31
PID 1288 wrote to memory of 1228	1288	cmd.exe	32
PID 1288 wrote to memory of 1228	1288	cmd.exe	32
PID 1288 wrote to memory of 1228	1288	cmd.exe	32
PID 1288 wrote to memory of 1228	1288	cmd.exe	32
PID 1288 wrote to memory of 1356	1288	cmd.exe	33
PID 1288 wrote to memory of 1356	1288	cmd.exe	33
PID 1288 wrote to memory of 1356	1288	cmd.exe	33
PID 1288 wrote to memory of 1356	1288	cmd.exe	33
PID 1288 wrote to memory of 1632	1288	cmd.exe	34
PID 1288 wrote to memory of 1632	1288	cmd.exe	34
PID 1288 wrote to memory of 1632	1288	cmd.exe	34
PID 1288 wrote to memory of 1632	1288	cmd.exe	34
PID 1356 wrote to memory of 412	1356	Neghi.exe.com	35
PID 1356 wrote to memory of 412	1356	Neghi.exe.com	35
PID 1356 wrote to memory of 412	1356	Neghi.exe.com	35
PID 1356 wrote to memory of 412	1356	Neghi.exe.com	35

C:\Users\Admin\AppData\Local\Temp\b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093.exe
"C:\Users\Admin\AppData\Local\Temp\b2ead315d6a392726c96cc0f928a5218ecc4282dacd43f36a249219391457093.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Ero.avi
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^nwOhgkZOkTAuHApAkWLoGKlGITnVtOaFGtNDNpuScYUkDxTFlwfAaAQOQoFxMrJvBUmDMFNePTNIPZehqSKrmRhuhZNFEMysfbKJUdSFgjLnMoY$" Bellissima.avi
      4⤵
      PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Neghi.exe.com
      Neghi.exe.com f
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Neghi.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Neghi.exe.com f
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:412
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-79-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1684-60-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing