0c02f3f8167cc00f4ea0f69c739cc5193f74b5c7bec00e1ba036e4e62efd63b9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d64ae61b1021edfdcc884b376a6dad0_NEAS.exe
Size

45KB
MD5

7d64ae61b1021edfdcc884b376a6dad0
SHA1

5f2f1e1978c74e235edb8995abf561fb95d258b2
SHA256

0c02f3f8167cc00f4ea0f69c739cc5193f74b5c7bec00e1ba036e4e62efd63b9
SHA512

4754412f7031fbfdd6d89bf56934340b5632b3f069a41dfd1f72166f4a4b3bfae9296f5bcf18ff0e09904098f727a0dd5bb4b923103d256dce3c4d51d39e21f1
SSDEEP

768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPhH:P6QFElP6k+MRQMOtEvwDpjBQpVXKH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	7d64ae61b1021edfdcc884b376a6dad0_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
4936	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4936	2440	7d64ae61b1021edfdcc884b376a6dad0_NEAS.exe	85
PID 2440 wrote to memory of 4936	2440	7d64ae61b1021edfdcc884b376a6dad0_NEAS.exe	85
PID 2440 wrote to memory of 4936	2440	7d64ae61b1021edfdcc884b376a6dad0_NEAS.exe	85

C:\Users\Admin\AppData\Local\Temp\7d64ae61b1021edfdcc884b376a6dad0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\7d64ae61b1021edfdcc884b376a6dad0_NEAS.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
1423e38f208e23a5c4f07df02ab37000

SHA1
45caf02017a6fe8df3044b0d6d9aad2bc5650f13

SHA256
c423aaa4a4bf8a0f42fe3d3b5ae0c421f509c057ce5ea508663d0f36cad37faa

SHA512
ab8a6ab9e3240233880bf5c27dbb62cef89d8da7fe0a6951c7010b0b2fe8f886ee2fdbf2c364aefbdffd9e694f579bdb85f2f01b2dd9c4800b5818af6edf0560

Download Submit
memory/2440-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2440-1-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2440-2-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/2440-9-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2440-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4936-19-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/4936-25-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/4936-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download