e053c06db3933a959530e768e3e0327e1feeef8913e29cbfa61a4c6e15d57ac5

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4438baace75f70871deae15b36f93c40.exe
Size

76KB
MD5

4438baace75f70871deae15b36f93c40
SHA1

74f5099f8b010b63f49762e161c33bb8538ff30c
SHA256

e053c06db3933a959530e768e3e0327e1feeef8913e29cbfa61a4c6e15d57ac5
SHA512

c28813a46fcac4b44b4b2fa09b1d659e7b3211f77585d37d910f75aa5bff9d64d8fb709d6c0969fc701880cc5f4883b53ed0b285921575d049a1874e6597982a
SSDEEP

768:EsJhM/47dTkc8jmiG/7H1SE3KGdA6jVS2bnKHtIGA8/nVNEcoX7zPjqEifb6o:EAA4R43e/7VOEjs2FRP2E6bB

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	NEAS.4438baace75f70871deae15b36f93c40.exe

Executes dropped EXE 1 IoCs

pid	Process
3308	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3308	2860	NEAS.4438baace75f70871deae15b36f93c40.exe	84
PID 2860 wrote to memory of 3308	2860	NEAS.4438baace75f70871deae15b36f93c40.exe	84
PID 2860 wrote to memory of 3308	2860	NEAS.4438baace75f70871deae15b36f93c40.exe	84

C:\Users\Admin\AppData\Local\Temp\NEAS.4438baace75f70871deae15b36f93c40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4438baace75f70871deae15b36f93c40.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wujek.exe

Filesize
76KB

MD5
04cd066e116445ce91fbac4967e08990

SHA1
f570d2fe492fce845b5d18c11192eca206846227

SHA256
ff32825f9b0e567bf92b40d4d2ef37f2ea6fa0478b0a35df442ac39ce871ef96

SHA512
9390d2fc40e79d9955e32219bfaeb0ac863a7e2b24fa2336c76b2becd3a752c3a7650f01712e3d06897314bad6cb692895b6a01e85b66663ff16dd4af03e9fb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\wujek.exe

Filesize
76KB

MD5
04cd066e116445ce91fbac4967e08990

SHA1
f570d2fe492fce845b5d18c11192eca206846227

SHA256
ff32825f9b0e567bf92b40d4d2ef37f2ea6fa0478b0a35df442ac39ce871ef96

SHA512
9390d2fc40e79d9955e32219bfaeb0ac863a7e2b24fa2336c76b2becd3a752c3a7650f01712e3d06897314bad6cb692895b6a01e85b66663ff16dd4af03e9fb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\wujek.exe

Filesize
76KB

MD5
04cd066e116445ce91fbac4967e08990

SHA1
f570d2fe492fce845b5d18c11192eca206846227

SHA256
ff32825f9b0e567bf92b40d4d2ef37f2ea6fa0478b0a35df442ac39ce871ef96

SHA512
9390d2fc40e79d9955e32219bfaeb0ac863a7e2b24fa2336c76b2becd3a752c3a7650f01712e3d06897314bad6cb692895b6a01e85b66663ff16dd4af03e9fb3

Download Submit
memory/2860-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3308-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download