08aad1aca4f18420fb1a7afab63f5123bcbb25b83615f36031be54bf46c10207

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2023, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.e6cff92963143c0a40f154daafb450dd.exe
Size

426KB
MD5

e6cff92963143c0a40f154daafb450dd
SHA1

01699630505ec41243a352389ba1bdece6ceb72d
SHA256

08aad1aca4f18420fb1a7afab63f5123bcbb25b83615f36031be54bf46c10207
SHA512

2a9d036b43459762d7dfd7024e5b8141f36581a76ea49dfcb97c8bd8a283acccc5c751ccf228357912360c62d53211e965b06f575514fbf392cc9495e3a5fdf9
SSDEEP

1536:vZ/fgEAqJlV+n1EgGHo7P1YPx28VayonYseB/Y:v1gEZl0nt/P1YPx/oni/Y

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.alizametal.com.tr
Port:
21
Username:
alizametal.com.tr
Password:
hd611

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation	NEAS.e6cff92963143c0a40f154daafb450dd.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9013443c\jusched.exe	NEAS.e6cff92963143c0a40f154daafb450dd.exe
File created	C:\Program Files (x86)\9013443c\9013443c	NEAS.e6cff92963143c0a40f154daafb450dd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	NEAS.e6cff92963143c0a40f154daafb450dd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2776	1224	NEAS.e6cff92963143c0a40f154daafb450dd.exe	93
PID 1224 wrote to memory of 2776	1224	NEAS.e6cff92963143c0a40f154daafb450dd.exe	93
PID 1224 wrote to memory of 2776	1224	NEAS.e6cff92963143c0a40f154daafb450dd.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.e6cff92963143c0a40f154daafb450dd.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e6cff92963143c0a40f154daafb450dd.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\9013443c\jusched.exe
  "C:\Program Files (x86)\9013443c\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\9013443c\9013443c

Filesize
17B

MD5
80e7928b124479791c52c09d831495f6

SHA1
94c8cb5ce4b1c1e70a2802efc22395c1003fc8bd

SHA256
a6bb92ad6bdd253818b2660e9befc8e3689b3bee61233f7a67a6ca0695acab12

SHA512
5183e48a8dc4f64277b7a0303f97b704ffa63dcc7256aaddb69994ef108f2f2922d9ec9a62eda403eed6c4f66dd719297c9d24e997f662eded63a49810493d2d

Download Submit
C:\Program Files (x86)\9013443c\jusched.exe

Filesize
426KB

MD5
6730b5b2708183c983b512ffa4c33efb

SHA1
5cdf21c70c2775b296aabedde1b4fce53a8e09aa

SHA256
410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8

SHA512
470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821

Download Submit
C:\Program Files (x86)\9013443c\jusched.exe

Filesize
426KB

MD5
6730b5b2708183c983b512ffa4c33efb

SHA1
5cdf21c70c2775b296aabedde1b4fce53a8e09aa

SHA256
410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8

SHA512
470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821

Download Submit
C:\Program Files (x86)\9013443c\jusched.exe

Filesize
426KB

MD5
6730b5b2708183c983b512ffa4c33efb

SHA1
5cdf21c70c2775b296aabedde1b4fce53a8e09aa

SHA256
410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8

SHA512
470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821

Download Submit
memory/1224-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2776-14-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download