96f193b9ab2b7a6e3017b80489583486458727d9be86c302669afb2b1972328c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.cef0c022ffacd0df644fa31a5aa2bd60.exe
Size

45KB
MD5

cef0c022ffacd0df644fa31a5aa2bd60
SHA1

6e2d4a744b29ad298e3a17e7040253d4dddf220e
SHA256

96f193b9ab2b7a6e3017b80489583486458727d9be86c302669afb2b1972328c
SHA512

06f66c38426d7f8ba2e214a6c973ac1b39c90bbe4156ea5dc22d4279ccdb4564609bd6ae969f6340f289e82b438bafdf4a23b7e6bb3ec014c0926dc2384ce48d
SSDEEP

384:u2T+/jvJ7+gFrJk04OMcYyOVJ9KRqnGTq/yX9k7uaaTiOmCdIniQG61COIV3NhW2:BOZ+gr36q1y/youIMdIniQG61tIVTB

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	NEAS.cef0c022ffacd0df644fa31a5aa2bd60.exe

Executes dropped EXE 1 IoCs

pid	Process
376	comupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 376	1852	NEAS.cef0c022ffacd0df644fa31a5aa2bd60.exe	91
PID 1852 wrote to memory of 376	1852	NEAS.cef0c022ffacd0df644fa31a5aa2bd60.exe	91
PID 1852 wrote to memory of 376	1852	NEAS.cef0c022ffacd0df644fa31a5aa2bd60.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.cef0c022ffacd0df644fa31a5aa2bd60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cef0c022ffacd0df644fa31a5aa2bd60.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\comupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\comupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\comupdater.exe

Filesize
46KB

MD5
90edf9e5f2e7fadf1e00b1d877605d94

SHA1
77dfe1de87476a4d697b3cc17b9e9b420a1c1028

SHA256
f327c8bc35b2b6b7cac7aae883c0e2600376b9c96888b99cceca4f992267c81b

SHA512
39399f58d5dba8ebd38d1d124ad6678347437f0c1b3d7213458c865836d281f7b59956e6af9f10b76803cf978fefbcbfc4a5087c8688b556183f9ef3e022357a

Download Submit
C:\Users\Admin\AppData\Local\Temp\comupdater.exe

Filesize
46KB

MD5
90edf9e5f2e7fadf1e00b1d877605d94

SHA1
77dfe1de87476a4d697b3cc17b9e9b420a1c1028

SHA256
f327c8bc35b2b6b7cac7aae883c0e2600376b9c96888b99cceca4f992267c81b

SHA512
39399f58d5dba8ebd38d1d124ad6678347437f0c1b3d7213458c865836d281f7b59956e6af9f10b76803cf978fefbcbfc4a5087c8688b556183f9ef3e022357a

Download Submit
C:\Users\Admin\AppData\Local\Temp\comupdater.exe

Filesize
46KB

MD5
90edf9e5f2e7fadf1e00b1d877605d94

SHA1
77dfe1de87476a4d697b3cc17b9e9b420a1c1028

SHA256
f327c8bc35b2b6b7cac7aae883c0e2600376b9c96888b99cceca4f992267c81b

SHA512
39399f58d5dba8ebd38d1d124ad6678347437f0c1b3d7213458c865836d281f7b59956e6af9f10b76803cf978fefbcbfc4a5087c8688b556183f9ef3e022357a

Download Submit
memory/376-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1852-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download