Analysis
-
max time kernel
121s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
12/11/2023, 18:34
General
-
Target
NEAS.93b85904ee44f0fb32002dabd8fc944262f57ca7fe62dc8c2a86fcddd7c5d7d5.exe
-
Size
80KB
-
MD5
f95789c092ce9f252857875c242f33d6
-
SHA1
ce6db0c9f829a7101825ef36c1e40f9e6047e829
-
SHA256
93b85904ee44f0fb32002dabd8fc944262f57ca7fe62dc8c2a86fcddd7c5d7d5
-
SHA512
97c132dcdb73b8057a9cf806bdec28f98241ece9d4eba314feb9c6f9aa8c9df908892083dbd75f32de205cfffcdae65a98613410ed49fa56dff7ef16d49a924c
-
SSDEEP
1536:lqjyXN0ly65p6wGYFEEDxSV7SRYnQm4dcslN4ZJjeSVtSWwnouy8jS:w+Xe58wGYFxDxSQpdcslNANV2outjS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.93b85904ee44f0fb32002dabd8fc944262f57ca7fe62dc8c2a86fcddd7c5d7d5.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.93b85904ee44f0fb32002dabd8fc944262f57ca7fe62dc8c2a86fcddd7c5d7d5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /release2⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 9282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1512 -ip 15121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1024KB
-
Filesize
308KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
308KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB