24d633b67de85c90c5612def6fae851b0592803024d4a101d247d52d2ac812ef

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.exe
Size

777KB
MD5

4abfaf19fd44f9b9ffc784aedfaefa60
SHA1

2bf3a7fb295863ef3771649685495f3515dab34c
SHA256

24d633b67de85c90c5612def6fae851b0592803024d4a101d247d52d2ac812ef
SHA512

8f45cf155d7a9a19c127fc9adc1607cde639731fab6bd6675920d500c83b98d04633fe737ae6d1a26c5a40b83bc41a3ccc72b38696d510255613be3fe1496e2d
SSDEEP

12288:4aHc64R1888888888888W88888888888EK3Oe5hLdGoNn+74bx6rPIasN8pc68bW:f86KIKL0sGhszbevHUizQwzUAja6APyb

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp

Executes dropped EXE 2 IoCs

pid	Process
1776	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp
1920	rkverify.exe

Loads dropped DLL 4 IoCs

pid	Process
1776	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp
1776	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp
1920	rkverify.exe
1776	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe
1920	rkverify.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1776	4880	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.exe	90
PID 4880 wrote to memory of 1776	4880	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.exe	90
PID 4880 wrote to memory of 1776	4880	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.exe	90
PID 1776 wrote to memory of 1920	1776	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp	94
PID 1776 wrote to memory of 1920	1776	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp	94
PID 1776 wrote to memory of 1920	1776	NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp	94

C:\Users\Admin\AppData\Local\Temp\NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\is-1VEN4.tmp\NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1VEN4.tmp\NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp" /SL5="$7016E,261042,119808,C:\Users\Admin\AppData\Local\Temp\NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\is-UPC8B.tmp\rkverify.exe
    "C:\Users\Admin\AppData\Local\Temp\is-UPC8B.tmp\rkverify.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1920

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CSMEFBF.tmp

Filesize
299KB

MD5
d40892a5ba953d7fd83cd529f87df0ac

SHA1
4f57a51dcc9f3312d7a02568981c8f1783391cc0

SHA256
dca6255185e07a313263f1c6d04908647d6e49abb3596c4d1691d6632613799e

SHA512
8483b81bf8ba84c35bb2d8b036fb1024b14eea17429bbd872b7e88fad7ad9ef65d6d583a3aafc060ae30b4e91a4a41a9caaeca0fa83a9e1065af791cb483a16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CSMEFBF.tmp

Filesize
299KB

MD5
d40892a5ba953d7fd83cd529f87df0ac

SHA1
4f57a51dcc9f3312d7a02568981c8f1783391cc0

SHA256
dca6255185e07a313263f1c6d04908647d6e49abb3596c4d1691d6632613799e

SHA512
8483b81bf8ba84c35bb2d8b036fb1024b14eea17429bbd872b7e88fad7ad9ef65d6d583a3aafc060ae30b4e91a4a41a9caaeca0fa83a9e1065af791cb483a16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CSMEFBF.tmp

Filesize
299KB

MD5
d40892a5ba953d7fd83cd529f87df0ac

SHA1
4f57a51dcc9f3312d7a02568981c8f1783391cc0

SHA256
dca6255185e07a313263f1c6d04908647d6e49abb3596c4d1691d6632613799e

SHA512
8483b81bf8ba84c35bb2d8b036fb1024b14eea17429bbd872b7e88fad7ad9ef65d6d583a3aafc060ae30b4e91a4a41a9caaeca0fa83a9e1065af791cb483a16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1VEN4.tmp\NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp

Filesize
1.1MB

MD5
d5d303dbabe599c5b4c9b96571d1b599

SHA1
265641e6144297bfe761ca3b332349e0d0b7a5b5

SHA256
e277bc4cc95eec3a3b1341270f62c12adcf2c6ed666f59f611219e4193d1fe44

SHA512
de44eac295721c07c789a1c5862e1522a0c0a73d0a0e6d016de60672fab447e7eae5b7b5ad9ae2be2cadf1d9559cdadc6bd2367a195172305085ab1bc2c683be

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1VEN4.tmp\NEAS.4abfaf19fd44f9b9ffc784aedfaefa60_JC.tmp

Filesize
1.1MB

MD5
d5d303dbabe599c5b4c9b96571d1b599

SHA1
265641e6144297bfe761ca3b332349e0d0b7a5b5

SHA256
e277bc4cc95eec3a3b1341270f62c12adcf2c6ed666f59f611219e4193d1fe44

SHA512
de44eac295721c07c789a1c5862e1522a0c0a73d0a0e6d016de60672fab447e7eae5b7b5ad9ae2be2cadf1d9559cdadc6bd2367a195172305085ab1bc2c683be

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPC8B.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPC8B.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPC8B.tmp\rkverify.exe

Filesize
595KB

MD5
60db193bce83f05363c874fec9b310c5

SHA1
e1ceb44b70f37f47d92a02c113b59414ba346d81

SHA256
10fb5a7c13814e3d45fabfe448ea1fd7e3a12fbded649385310b005cfe8ab18f

SHA512
6b87de59cd3e769c2a4eb8db24f1c3c5d7eea78abd014fa326da8b4d1b119d2d7a9796ccc8d38e51ec963d9f7e13bc46c34293cae411159c83849d78a7bc81a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPC8B.tmp\rkverify.exe

Filesize
595KB

MD5
60db193bce83f05363c874fec9b310c5

SHA1
e1ceb44b70f37f47d92a02c113b59414ba346d81

SHA256
10fb5a7c13814e3d45fabfe448ea1fd7e3a12fbded649385310b005cfe8ab18f

SHA512
6b87de59cd3e769c2a4eb8db24f1c3c5d7eea78abd014fa326da8b4d1b119d2d7a9796ccc8d38e51ec963d9f7e13bc46c34293cae411159c83849d78a7bc81a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPC8B.tmp\rkverify.exe

Filesize
595KB

MD5
60db193bce83f05363c874fec9b310c5

SHA1
e1ceb44b70f37f47d92a02c113b59414ba346d81

SHA256
10fb5a7c13814e3d45fabfe448ea1fd7e3a12fbded649385310b005cfe8ab18f

SHA512
6b87de59cd3e769c2a4eb8db24f1c3c5d7eea78abd014fa326da8b4d1b119d2d7a9796ccc8d38e51ec963d9f7e13bc46c34293cae411159c83849d78a7bc81a2

Download Submit
memory/1776-12-0x0000000003320000-0x000000000335C000-memory.dmp

Filesize
240KB

Download
memory/1776-34-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1776-35-0x0000000076980000-0x0000000076B20000-memory.dmp

Filesize
1.6MB

Download
memory/1776-36-0x0000000077350000-0x0000000077374000-memory.dmp

Filesize
144KB

Download
memory/1776-37-0x0000000077380000-0x000000007745C000-memory.dmp

Filesize
880KB

Download
memory/1776-38-0x0000000003320000-0x000000000335C000-memory.dmp

Filesize
240KB

Download
memory/1776-39-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1776-40-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

Filesize
64KB

Download
memory/1776-6-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1776-43-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1776-44-0x0000000076980000-0x0000000076B20000-memory.dmp

Filesize
1.6MB

Download
memory/4880-16-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4880-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download