ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931

General

Target

ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe
Size

910KB
MD5

503b36cc8f02f72879f16dfa0619f3ab
SHA1

00494f017d82f370f2d32d0e8d7a762dacf6cbf1
SHA256

ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931
SHA512

28ef531c908beedabb00506d1a1aa1f78249b7b2cf1025553d5410112c86bf8d066774d2d14c3434d1b4a1f141eb2df67d25480d4c3b2decc949a1ca8b73cd19
SSDEEP

6144:iKG71yx+FuJgLbEI08BmcHPKXND+9x0h8KEy1iNjxYruPyhrEYCblSakBSMb/uRH:ihIWLEI08B3HkZ+IHTCyrplXSdX3

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2808	neomc.exe
308	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2808	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	84
PID 3592 wrote to memory of 2808	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	84
PID 3592 wrote to memory of 2808	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	84
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86
PID 3592 wrote to memory of 308	3592	ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe	86

C:\Users\Admin\AppData\Local\Temp\ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe
"C:\Users\Admin\AppData\Local\Temp\ff305ad5fbf3171f30d8a130a685be0f8438e7dce38adcea27b8fce36eebf931.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\neomc.exe
  "C:\Users\Admin\AppData\Local\Temp\neomc.exe"
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
  2⤵
  - Executes dropped EXE
  PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\explorer.exe

Filesize
45KB

MD5
b7c999040d80e5bf87886d70d992c51e

SHA1
a8ed9a51cc14ccf99b670e60ebbc110756504929

SHA256
5c3257b277f160109071e7e716040e67657341d8c42aa68d9afafe1630fcc53e

SHA512
71ba2fbd705e51b488afe3bb33a67212cf297e97e8b1b20ada33e16956f7ec8f89a79e04a4b256fd61a442fada690aff0c807c2bdcc9165a9c7be3de725de309

Download Submit
C:\Users\Admin\AppData\Local\Temp\neomc.exe

Filesize
9KB

MD5
77120b7c8fe0983b6e84b9a19649b39a

SHA1
a51ad60a7637370796f099493a6bc4242de578e4

SHA256
475b60033281d7576a39a41dfd2761c185b4cdd69edd54a14589596fe51efae5

SHA512
47ff461c3fc6e8f11c74d4f7a532352756c646cc282383b3d023cf88e8871258e1c85058b62e0113dd5ba1d3fd936b29b0935e49be51ce4835a09cdaad9e1791

Download Submit
C:\Users\Admin\AppData\Local\Temp\neomc.exe

Filesize
9KB

MD5
77120b7c8fe0983b6e84b9a19649b39a

SHA1
a51ad60a7637370796f099493a6bc4242de578e4

SHA256
475b60033281d7576a39a41dfd2761c185b4cdd69edd54a14589596fe51efae5

SHA512
47ff461c3fc6e8f11c74d4f7a532352756c646cc282383b3d023cf88e8871258e1c85058b62e0113dd5ba1d3fd936b29b0935e49be51ce4835a09cdaad9e1791

Download Submit
memory/308-141-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-144-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-152-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-138-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-139-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-150-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-143-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-145-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-148-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/308-149-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3592-133-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3592-132-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3592-151-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing