7ebf85327a80cf103e255c1d807adee71ac97ec6f38d25ff6d3894ee1e45d5b8

Analysis

max time kernel
151s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.922fe25b6ee750d2e100fc4151b45f00.exe
Size

55KB
MD5

922fe25b6ee750d2e100fc4151b45f00
SHA1

e6905dd37bb0860d17fde0f4fb99d148211ed802
SHA256

7ebf85327a80cf103e255c1d807adee71ac97ec6f38d25ff6d3894ee1e45d5b8
SHA512

4243ab98b0f73b2cad869755153a790017574b69d238b210b40a85c848556dc4b024a2e5a92ac8379387541b6ebd65376e88d9e911e6670b56b7ca56d96b4260
SSDEEP

768:Iv9ilrnywLsYg+0yq2vWdT9SOaNou0yWH7oXzO8ZGjSjAsOm7IfCus6YnFAi5y98:fjxsz40yvXHGjUAsOs/ukv

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	NEAS.922fe25b6ee750d2e100fc4151b45f00.exe

Executes dropped EXE 1 IoCs

pid	Process
1064	conwurm.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2556-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/files/0x0006000000022cfd-8.dat	upx
behavioral2/files/0x0006000000022cfd-10.dat	upx
behavioral2/files/0x0006000000022cfd-11.dat	upx
behavioral2/memory/2556-14-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1064-16-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1064	2556	NEAS.922fe25b6ee750d2e100fc4151b45f00.exe	93
PID 2556 wrote to memory of 1064	2556	NEAS.922fe25b6ee750d2e100fc4151b45f00.exe	93
PID 2556 wrote to memory of 1064	2556	NEAS.922fe25b6ee750d2e100fc4151b45f00.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.922fe25b6ee750d2e100fc4151b45f00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.922fe25b6ee750d2e100fc4151b45f00.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\conwurm.exe
  "C:\Users\Admin\AppData\Local\Temp\conwurm.exe"
  2⤵
  - Executes dropped EXE
  PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\conwurm.exe

Filesize
55KB

MD5
360e4e608ac00cdd7a602e34006b3070

SHA1
a6be22d2b077bb7c7b34fb3f96a9e564c93ba8f9

SHA256
2d33aa07306043413058999b0f6ff2f61f92ec2f457470f13a67498e30b9e768

SHA512
3ecdb2f5f84c97df077b93a4ad8af86224bff5f3851f1942761a96abe88e1bb5ce8fb72dc9305271e99ac5f4d4e2f5584ac399dc019cf1fda0240f73c3d71153

Download Submit
C:\Users\Admin\AppData\Local\Temp\conwurm.exe

Filesize
55KB

MD5
360e4e608ac00cdd7a602e34006b3070

SHA1
a6be22d2b077bb7c7b34fb3f96a9e564c93ba8f9

SHA256
2d33aa07306043413058999b0f6ff2f61f92ec2f457470f13a67498e30b9e768

SHA512
3ecdb2f5f84c97df077b93a4ad8af86224bff5f3851f1942761a96abe88e1bb5ce8fb72dc9305271e99ac5f4d4e2f5584ac399dc019cf1fda0240f73c3d71153

Download Submit
C:\Users\Admin\AppData\Local\Temp\conwurm.exe

Filesize
55KB

MD5
360e4e608ac00cdd7a602e34006b3070

SHA1
a6be22d2b077bb7c7b34fb3f96a9e564c93ba8f9

SHA256
2d33aa07306043413058999b0f6ff2f61f92ec2f457470f13a67498e30b9e768

SHA512
3ecdb2f5f84c97df077b93a4ad8af86224bff5f3851f1942761a96abe88e1bb5ce8fb72dc9305271e99ac5f4d4e2f5584ac399dc019cf1fda0240f73c3d71153

Download Submit
memory/1064-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1064-18-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/2556-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2556-1-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/2556-3-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/2556-2-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/2556-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download