1f1a30b3bd7a064d8ea0ec12aa67e796e83556e61f423b4a3ff89d0f44373762

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.e418cb059a8bdfbf8570a2ef97b61070.exe
Size

23KB
MD5

e418cb059a8bdfbf8570a2ef97b61070
SHA1

7d0781ac9ec87b50d8cebfac93f0c1c04a991f0e
SHA256

1f1a30b3bd7a064d8ea0ec12aa67e796e83556e61f423b4a3ff89d0f44373762
SHA512

21ee6e251be9513a67bf243fe75448db3fdd93e69e75e277b35a353b3ba960b664816b48505c071cec58158a41caec5cbb2ce1cb2a3572948caa6a60b459969b
SSDEEP

384:Dh2uKtn2f09/7wXR9cq+mwjgOZhRKvkRWadPFAvEoJpSr1xeMT/:L4Y8qR9cq7qdWadPFAvbs

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	NEAS.e418cb059a8bdfbf8570a2ef97b61070.exe

Executes dropped EXE 1 IoCs

pid	Process
5080	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 5080	2148	NEAS.e418cb059a8bdfbf8570a2ef97b61070.exe	88
PID 2148 wrote to memory of 5080	2148	NEAS.e418cb059a8bdfbf8570a2ef97b61070.exe	88
PID 2148 wrote to memory of 5080	2148	NEAS.e418cb059a8bdfbf8570a2ef97b61070.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.e418cb059a8bdfbf8570a2ef97b61070.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e418cb059a8bdfbf8570a2ef97b61070.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
23KB

MD5
d9cb3d928fd233f45101eeb60b1675b2

SHA1
db257117db542ff02225deff4a98bfa6b721525f

SHA256
2d9ee00234ba45697ac07bbe98fb83007029626650e78354a441851cb576255e

SHA512
b62b53e42a518365dc8d74a55844d2a4954b8c4a2d5f7644e65eaf90a068ce34ab31e2f6f9dfd650634df692e98ace78e6345abe4e3e524d7559c16ad1248d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
23KB

MD5
d9cb3d928fd233f45101eeb60b1675b2

SHA1
db257117db542ff02225deff4a98bfa6b721525f

SHA256
2d9ee00234ba45697ac07bbe98fb83007029626650e78354a441851cb576255e

SHA512
b62b53e42a518365dc8d74a55844d2a4954b8c4a2d5f7644e65eaf90a068ce34ab31e2f6f9dfd650634df692e98ace78e6345abe4e3e524d7559c16ad1248d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
23KB

MD5
d9cb3d928fd233f45101eeb60b1675b2

SHA1
db257117db542ff02225deff4a98bfa6b721525f

SHA256
2d9ee00234ba45697ac07bbe98fb83007029626650e78354a441851cb576255e

SHA512
b62b53e42a518365dc8d74a55844d2a4954b8c4a2d5f7644e65eaf90a068ce34ab31e2f6f9dfd650634df692e98ace78e6345abe4e3e524d7559c16ad1248d2b

Download Submit
memory/2148-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2148-1-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/2148-2-0x0000000002180000-0x0000000002187000-memory.dmp

Filesize
28KB

Download
memory/2148-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5080-12-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/5080-13-0x0000000002050000-0x0000000002057000-memory.dmp

Filesize
28KB

Download
memory/5080-18-0x0000000002050000-0x0000000002057000-memory.dmp

Filesize
28KB

Download
memory/5080-17-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download