644b663afe79a763e51bcb456028b6a97d9bac72fc34730d229fcbe5f5cb93e3

Analysis

max time kernel
162s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.22614945f4651df80fcdea16355d9020.exe
Size

600KB
MD5

22614945f4651df80fcdea16355d9020
SHA1

111ee418779b105780aa1cbb178cc00310f83943
SHA256

644b663afe79a763e51bcb456028b6a97d9bac72fc34730d229fcbe5f5cb93e3
SHA512

6bc53f95146318c8b8debd471fe53bb24b58608bef72d2712bc70bea03d5f5736b78e56fef92b9576bb26fa458337370e5edfd4e6274291d3571e73f5073c41e
SSDEEP

6144:NptVO7mOV1u9MV0ue9Ya47I9Ya4oXtamAV3vQnx04EFtUXMamoa9tG6tP/q8f/Ps:NhEDfP/q8fmRYCKREDAc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	NEAS.22614945f4651df80fcdea16355d9020.exe

Executes dropped EXE 1 IoCs

pid	Process
3992	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 3992	4060	NEAS.22614945f4651df80fcdea16355d9020.exe	93
PID 4060 wrote to memory of 3992	4060	NEAS.22614945f4651df80fcdea16355d9020.exe	93
PID 4060 wrote to memory of 3992	4060	NEAS.22614945f4651df80fcdea16355d9020.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.22614945f4651df80fcdea16355d9020.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.22614945f4651df80fcdea16355d9020.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
600KB

MD5
8aab15288c39bc0e19c524251e2cf06d

SHA1
0e7c3ecef6df4568552dc81ec62931ae282e2c7c

SHA256
60b52c810c995da16d60a9b99224da1b327d9800e50b05acf0f8186dbfa506ad

SHA512
051cb02b40dd245a40b3b89c480052d4d824db75018b693fc4a2f77bc3c2ad8cdad2505a65eaa8b9f4b3428db26d8dc63ff72f28e7e21797a3ca70effc2c5638

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
600KB

MD5
8aab15288c39bc0e19c524251e2cf06d

SHA1
0e7c3ecef6df4568552dc81ec62931ae282e2c7c

SHA256
60b52c810c995da16d60a9b99224da1b327d9800e50b05acf0f8186dbfa506ad

SHA512
051cb02b40dd245a40b3b89c480052d4d824db75018b693fc4a2f77bc3c2ad8cdad2505a65eaa8b9f4b3428db26d8dc63ff72f28e7e21797a3ca70effc2c5638

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
600KB

MD5
8aab15288c39bc0e19c524251e2cf06d

SHA1
0e7c3ecef6df4568552dc81ec62931ae282e2c7c

SHA256
60b52c810c995da16d60a9b99224da1b327d9800e50b05acf0f8186dbfa506ad

SHA512
051cb02b40dd245a40b3b89c480052d4d824db75018b693fc4a2f77bc3c2ad8cdad2505a65eaa8b9f4b3428db26d8dc63ff72f28e7e21797a3ca70effc2c5638

Download Submit
memory/3992-16-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/3992-17-0x0000000002630000-0x0000000002A30000-memory.dmp

Filesize
4.0MB

Download
memory/3992-25-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4060-0-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4060-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4060-2-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4060-3-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/4060-5-0x0000000002700000-0x0000000002B00000-memory.dmp

Filesize
4.0MB

Download
memory/4060-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download