7c75520394d058d7cca4fc3d2ab6929f29d1dc0b2636a807865bd9d709037a71

Analysis

max time kernel
151s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.a964b94917890ebd8c04342be5e79640.exe
Size

6KB
MD5

a964b94917890ebd8c04342be5e79640
SHA1

0ee6b226990a7f339a2b41bd4eacee157686854a
SHA256

7c75520394d058d7cca4fc3d2ab6929f29d1dc0b2636a807865bd9d709037a71
SHA512

6e1798681e66e9fc63e94d33c9747622b301b260afab5fc70f8043125456a89191aa74f84fc51118e2199d542ac86f515982d41a2a1f607d829abe528d81fa04
SSDEEP

96:ZWgn/x6z0AjDXX6Hb3RngnKymV44Abg0DnjofL4Ch20bB1rA1bolYqz8DO2P+:Yi5qDXX6dngnKfzeMfd7V1rA1Meqz8Y

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	NEAS.a964b94917890ebd8c04342be5e79640.exe

Executes dropped EXE 1 IoCs

pid	Process
4884	ssemt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4884	5076	NEAS.a964b94917890ebd8c04342be5e79640.exe	87
PID 5076 wrote to memory of 4884	5076	NEAS.a964b94917890ebd8c04342be5e79640.exe	87
PID 5076 wrote to memory of 4884	5076	NEAS.a964b94917890ebd8c04342be5e79640.exe	87

C:\Users\Admin\AppData\Local\Temp\NEAS.a964b94917890ebd8c04342be5e79640.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a964b94917890ebd8c04342be5e79640.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\ssemt.exe
  "C:\Users\Admin\AppData\Local\Temp\ssemt.exe"
  2⤵
  - Executes dropped EXE
  PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ssemt.exe

Filesize
7KB

MD5
60b14ab73da6e5e5062acefbc56ccd1c

SHA1
d243b3495c620efa2d4ae96048a561722a34c4d5

SHA256
a23eb200619b2bf6736c62e91a9430f9796d74e484db711885d0b64fe01eafcc

SHA512
61c05ebb9b97f3d859d35d49c1ecefba36f7fcac1c2f87dd43491dbd24e4afef3e60a95897f60141b89925b22ee5d9ca301e5efe4d8a9c6f8d592266d5cbaca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ssemt.exe

Filesize
7KB

MD5
60b14ab73da6e5e5062acefbc56ccd1c

SHA1
d243b3495c620efa2d4ae96048a561722a34c4d5

SHA256
a23eb200619b2bf6736c62e91a9430f9796d74e484db711885d0b64fe01eafcc

SHA512
61c05ebb9b97f3d859d35d49c1ecefba36f7fcac1c2f87dd43491dbd24e4afef3e60a95897f60141b89925b22ee5d9ca301e5efe4d8a9c6f8d592266d5cbaca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ssemt.exe

Filesize
7KB

MD5
60b14ab73da6e5e5062acefbc56ccd1c

SHA1
d243b3495c620efa2d4ae96048a561722a34c4d5

SHA256
a23eb200619b2bf6736c62e91a9430f9796d74e484db711885d0b64fe01eafcc

SHA512
61c05ebb9b97f3d859d35d49c1ecefba36f7fcac1c2f87dd43491dbd24e4afef3e60a95897f60141b89925b22ee5d9ca301e5efe4d8a9c6f8d592266d5cbaca4

Download Submit