f2866b86d795b9d6be5372690135a57fc6acbf2891dee29194cb0d73c0ec2bee

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe
Size

482KB
MD5

966ce1ad1b39041f8af5355c3d4f89e0
SHA1

8c220be3d7e37a2c546fd17b8f11ccc26d5a741e
SHA256

f2866b86d795b9d6be5372690135a57fc6acbf2891dee29194cb0d73c0ec2bee
SHA512

445803a15f49c02645d3862f04265778dca6df0285ab7a873e552cea76fcfc4736ca8bdda1e5015b092bfdfbe2a64061df758f6a87685f18a0fb9aa0b6c03718
SSDEEP

6144:2VTqrW9Q2dMtLrg4zhStfz1Sr8xgDsUh4zhStfz1NDsUh4zhSob:2V2rW9H+t3871Tot71No

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe

Executes dropped EXE 1 IoCs

pid	Process
4400	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\8ed7e7d6\jusched.exe	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe
File created	C:\Program Files (x86)\8ed7e7d6\8ed7e7d6	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4400	1112	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe	95
PID 1112 wrote to memory of 4400	1112	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe	95
PID 1112 wrote to memory of 4400	1112	NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe	95

C:\Users\Admin\AppData\Local\Temp\NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.966ce1ad1b39041f8af5355c3d4f89e0.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\8ed7e7d6\jusched.exe
  "C:\Program Files (x86)\8ed7e7d6\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\8ed7e7d6\8ed7e7d6

Filesize
17B

MD5
209aa6c14d66621f3aa1cee03a8bf5dc

SHA1
0f5bce2a29d3306586934b6d846a172078ee8e66

SHA256
57ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e

SHA512
8b9fb2bcc8e8785a48d3fe212f852c2f108ef2ab20e9e2a61e9bba5857002abe9111e42411bfc573e50c126031b7ef0433bddfa357de2ca0814f7d31157b9c63

Download Submit
C:\Program Files (x86)\8ed7e7d6\jusched.exe

Filesize
482KB

MD5
1364f85d02468fbff42b3455100fe409

SHA1
282e45a5b4931138bf76dc77460c8c3e5fd70435

SHA256
5b7ee3fbcf3de17287bb78f1006862109ff975976f40bf5ff34a5251d8c1b1f3

SHA512
5779f3ac7b4f71683e2dc4de0b4a57bb01ee32e26ce327a5e75116d9bf3da8e034a5b9d538f2a15f3cc160054856bfe8017fcb1aef08b69dbaef1c1ab732f026

Download Submit
C:\Program Files (x86)\8ed7e7d6\jusched.exe

Filesize
482KB

MD5
1364f85d02468fbff42b3455100fe409

SHA1
282e45a5b4931138bf76dc77460c8c3e5fd70435

SHA256
5b7ee3fbcf3de17287bb78f1006862109ff975976f40bf5ff34a5251d8c1b1f3

SHA512
5779f3ac7b4f71683e2dc4de0b4a57bb01ee32e26ce327a5e75116d9bf3da8e034a5b9d538f2a15f3cc160054856bfe8017fcb1aef08b69dbaef1c1ab732f026

Download Submit
C:\Program Files (x86)\8ed7e7d6\jusched.exe

Filesize
482KB

MD5
1364f85d02468fbff42b3455100fe409

SHA1
282e45a5b4931138bf76dc77460c8c3e5fd70435

SHA256
5b7ee3fbcf3de17287bb78f1006862109ff975976f40bf5ff34a5251d8c1b1f3

SHA512
5779f3ac7b4f71683e2dc4de0b4a57bb01ee32e26ce327a5e75116d9bf3da8e034a5b9d538f2a15f3cc160054856bfe8017fcb1aef08b69dbaef1c1ab732f026

Download Submit
memory/1112-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1112-15-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4400-14-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4400-17-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download