ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30aa5126abda19531174323dff513c80_NEAS.exe
Size

24KB
MD5

30aa5126abda19531174323dff513c80
SHA1

992ec6ca6dfbe8a92980e0a9e344ad089c4ded53
SHA256

ebff78c6e1f1831dca067f64f6e8fb9ee8947816e6baa8beee542399b92c5ef6
SHA512

f41e9f34834220a6e331a47eb35420a7b64e30630007e3ac15c5abf01246290e8dfe8a9a39f6bf3b1020ab37f98247fdd55766c1dad840f89b0f6c7afac95398
SSDEEP

384:+7ZfapsmVHgRK/rJ1OetA8gA49lBrenVyG+txHBtNsmSJJEFk2:OpgTARK/rRggVGhBRAEy2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	30aa5126abda19531174323dff513c80_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	updatepdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2560	4308	30aa5126abda19531174323dff513c80_NEAS.exe	85
PID 4308 wrote to memory of 2560	4308	30aa5126abda19531174323dff513c80_NEAS.exe	85
PID 4308 wrote to memory of 2560	4308	30aa5126abda19531174323dff513c80_NEAS.exe	85

C:\Users\Admin\AppData\Local\Temp\30aa5126abda19531174323dff513c80_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\30aa5126abda19531174323dff513c80_NEAS.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\updatepdf.exe
  "C:\Users\Admin\AppData\Local\Temp\updatepdf.exe"
  2⤵
  - Executes dropped EXE
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\updatepdf.exe

Filesize
24KB

MD5
a6fa7c8a2dd95d92e8a543f8d07b68f0

SHA1
39b9a2c7a15c8be4d6ef055a347d2daec5857f7c

SHA256
c6f47a98eb4022af489ae2ab1ad3d08f2fba9c2e0ebbb04bf0e4fe3b80ca20ad

SHA512
4949ec764d8215be2e3c827db6d316b5206cefa614dfc0b4439a3544f5b8872c51dd4b3ba0f6a5816304e4cd88b602fdd5eadfc03d60728612e7023db4c1ace7

Download Submit
memory/2560-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4308-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download