de2e5719e1af1f68da1f9e05d7dbc0a5df8e9b76c39598ffcbdd8cf9d26ed0de

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.2f9a1758dd6b4f2cd947958f74526020.exe
Size 124KB
Sample231103-pkafcsce63
SHA256 de2e5719e1af1f68da1f9e05d7dbc0a5df8e9b76c39598ffcbdd8cf9d26ed0de
MD5 2f9a1758dd6b4f2cd947958f74526020
SHA1 420ea561cb4833fce4ffb93032c7390e0555f3c6
SHA512 d4d68e37fbf58671bb0b041e862b1914aaadb470cbcd4e67661b2c5f4ffb01a95686ba0b9c371273968d1524f44e3110476eb67ce644e6ca7488353efbffbe6a
SSDEEP 3072:/q8f/oic1i9uTAlPQSDwEyWefHEvGdxETCpPJZ:C8f/U1iF/sUGdxETI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation	NEAS.2f9a1758dd6b4f2cd947958f74526020.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2796	NEAS.2f9a1758dd6b4f2cd947958f74526020.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3568	2796	NEAS.2f9a1758dd6b4f2cd947958f74526020.exe	89
PID 2796 wrote to memory of 3568	2796	NEAS.2f9a1758dd6b4f2cd947958f74526020.exe	89
PID 2796 wrote to memory of 3568	2796	NEAS.2f9a1758dd6b4f2cd947958f74526020.exe	89
PID 3568 wrote to memory of 1156	3568	cmd.exe	92
PID 3568 wrote to memory of 1156	3568	cmd.exe	92
PID 3568 wrote to memory of 1156	3568	cmd.exe	92

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1156	attrib.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.2f9a1758dd6b4f2cd947958f74526020.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2f9a1758dd6b4f2cd947958f74526020.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\sbqED57.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\NEAS.2f9a1758dd6b4f2cd947958f74526020.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\NEAS.2f9a1758dd6b4f2cd947958f74526020.exe"
    3⤵
    - Views/modifies file attributes
    PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sbqED57.tmp.bat

Path C:\Users\Admin\AppData\Roaming\sbqED57.tmp.bat
Size 59B
SHA256 603258d64f53aab9fb5ae04344eaa6431e7e9053c34cb42229be2f27020b8085
MD5 d047ab1ff9b21401a3d80ef3a47c35e8
SHA1 e3520008b2ff95865fe1d6192f95b72fbb3e787e
SHA512 97c5dffee809ca0dfefdabfb9d3caf15b43903a7ef0f84cb18cafccb3456acabc4431302fbf8d41f04338a8ffe3343aff6b86cc4c516cd8b05ce19bfa822b6c3
MD5 SHA1 SHA512

Submit Download

memory/2796-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2796-5-0x0000000000400000-0x000000000042D000-memory.dmp