a56e66b3f1ec0b84d9cee900373e564bf07769cab43d48f0ba65202433e349d6

Analysis

max time kernel
146s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.76b0232aed442ab6c62a063a89059070.exe
Size

31KB
MD5

76b0232aed442ab6c62a063a89059070
SHA1

855d51e744852f1b5c521af70fe671d611bee61a
SHA256

a56e66b3f1ec0b84d9cee900373e564bf07769cab43d48f0ba65202433e349d6
SHA512

fafac9e2cb16d71993b69153c704cbb4452c26c534e84e545694fbc78bdd7e98c9b26c2de415106515754aa9e0117c6704081ff21b4e2cb6d272ea15946a08b7
SSDEEP

384:cJK3FwyHsmev9n96oTlzcFihsHReNWpgVQYAUYVOBDmP7lOmqL8R:qK3psxrJzcFiAgWSrA7oBD07lfR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	NEAS.76b0232aed442ab6c62a063a89059070.exe

Executes dropped EXE 1 IoCs

pid	Process
2488	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 2488	3244	NEAS.76b0232aed442ab6c62a063a89059070.exe	86
PID 3244 wrote to memory of 2488	3244	NEAS.76b0232aed442ab6c62a063a89059070.exe	86
PID 3244 wrote to memory of 2488	3244	NEAS.76b0232aed442ab6c62a063a89059070.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.76b0232aed442ab6c62a063a89059070.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.76b0232aed442ab6c62a063a89059070.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
31KB

MD5
b8e0849b5fbfefa0dc06bdf8e664a2d9

SHA1
27242fb2ccb1a6c27668f7ce6898572f2cd4a1b6

SHA256
5dab8a291f5c62a1082e1e7cd5885a7733e7121622d4165ab4a0b197ffe96972

SHA512
7ecae9d08deae7ea52c78a054cd99d6964d37cd2e8446145e0dfdbc23d0c93fcf84f8a3f10796e9aa34a637de3c7e5a5fb8fc265958e99651430b7b0bef7d6f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
31KB

MD5
b8e0849b5fbfefa0dc06bdf8e664a2d9

SHA1
27242fb2ccb1a6c27668f7ce6898572f2cd4a1b6

SHA256
5dab8a291f5c62a1082e1e7cd5885a7733e7121622d4165ab4a0b197ffe96972

SHA512
7ecae9d08deae7ea52c78a054cd99d6964d37cd2e8446145e0dfdbc23d0c93fcf84f8a3f10796e9aa34a637de3c7e5a5fb8fc265958e99651430b7b0bef7d6f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
31KB

MD5
b8e0849b5fbfefa0dc06bdf8e664a2d9

SHA1
27242fb2ccb1a6c27668f7ce6898572f2cd4a1b6

SHA256
5dab8a291f5c62a1082e1e7cd5885a7733e7121622d4165ab4a0b197ffe96972

SHA512
7ecae9d08deae7ea52c78a054cd99d6964d37cd2e8446145e0dfdbc23d0c93fcf84f8a3f10796e9aa34a637de3c7e5a5fb8fc265958e99651430b7b0bef7d6f3

Download Submit
memory/2488-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-13-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2488-14-0x0000000002490000-0x0000000002890000-memory.dmp

Filesize
4.0MB

Download
memory/2488-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3244-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3244-1-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/3244-3-0x00000000025C0000-0x00000000029C0000-memory.dmp

Filesize
4.0MB

Download
memory/3244-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download