b4ef2c05e5bda32c7ac5d7e2a6f2bcb9df4727c7dd44f8e86ee0e32f2a54a05f

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe
Size

58KB
MD5

b9d3a4cc85f9a26015fe4479d0812e49
SHA1

d34eb58d54d120c7243c882d54baa96e75e2b06a
SHA256

b4ef2c05e5bda32c7ac5d7e2a6f2bcb9df4727c7dd44f8e86ee0e32f2a54a05f
SHA512

cfd4630d71900487358df8d3f938cca5138db90a3dac1b02e4868e81308942b23dafd3d7826cccacbca836a45dd740534fd959087eb2f5367d59c559ba5d6f3d
SSDEEP

768:MDcpEBMLfQcubV5wGE96YyXDTLdNSSS583:MDcfLfIbtEbyXfZb

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3060	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4040	riyhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\riyhost.exe	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe
File opened for modification	C:\Windows\Debug\riyhost.exe	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe
File opened for modification	C:\Windows\Debug\riyhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4400	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3060	4400	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	85
PID 4400 wrote to memory of 3060	4400	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	85
PID 4400 wrote to memory of 3060	4400	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	85
PID 4400 wrote to memory of 4168	4400	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	89
PID 4400 wrote to memory of 4168	4400	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	89
PID 4400 wrote to memory of 4168	4400	NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe	89

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3060	attrib.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b9d3a4cc85f9a26015fe4479d0812e49_JC.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\riyhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\NEASB9~1.EXE > nul
  2⤵
  PID:4168

C:\Windows\Debug\riyhost.exe
C:\Windows\Debug\riyhost.exe
1⤵
- Executes dropped EXE
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\riyhost.exe

Filesize
58KB

MD5
d94f17009f3041774d1e9371e021916a

SHA1
23d0323948a3e52dc73a420bbde82ed1ba81ffba

SHA256
dde5d5e13526efc4cec62257822844b89f0f4d728d4633059734112bacd3d784

SHA512
a48f2c24907d494114f7b3a26c30c83a90740dab95b7b953f97173f6d49ea559d6d671639c7ffaf369384ae2eb49095aa3a632493720004ee8e6c9dd60ae1d23

Download Submit
C:\Windows\debug\riyhost.exe

Filesize
58KB

MD5
d94f17009f3041774d1e9371e021916a

SHA1
23d0323948a3e52dc73a420bbde82ed1ba81ffba

SHA256
dde5d5e13526efc4cec62257822844b89f0f4d728d4633059734112bacd3d784

SHA512
a48f2c24907d494114f7b3a26c30c83a90740dab95b7b953f97173f6d49ea559d6d671639c7ffaf369384ae2eb49095aa3a632493720004ee8e6c9dd60ae1d23

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads