f414978cf11dc507acec308d4d8fb64608b9db2daafe751016f9c8f63b2b30cb

Analysis

max time kernel
130s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

699b8843fdfd30e4b8ba50a49acc37c0_NEAS.exe
Size

32KB
MD5

699b8843fdfd30e4b8ba50a49acc37c0
SHA1

0b81c001c219b449b7e942c6fc1fc33d4173d285
SHA256

f414978cf11dc507acec308d4d8fb64608b9db2daafe751016f9c8f63b2b30cb
SHA512

a928046d39031debe4b14eedd4daa0ef87de4f4a89ef0413018f56f05c5a470cf27606fa632cbe76628686980134a9b78990da35817a17b48635865e4b833b04
SSDEEP

384:7VG/EvX8tHEnD+rPkChwWs2wToy8qSbsTo+mmzugT3q3ExEFtF2bcB+f:7I4DD+LzRRqjTo+FuE6ExcLIf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	699b8843fdfd30e4b8ba50a49acc37c0_NEAS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	fahik.exe

Executes dropped EXE 1 IoCs

pid	Process
1972	fahik.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1972	2756	699b8843fdfd30e4b8ba50a49acc37c0_NEAS.exe	85
PID 2756 wrote to memory of 1972	2756	699b8843fdfd30e4b8ba50a49acc37c0_NEAS.exe	85
PID 2756 wrote to memory of 1972	2756	699b8843fdfd30e4b8ba50a49acc37c0_NEAS.exe	85

C:\Users\Admin\AppData\Local\Temp\699b8843fdfd30e4b8ba50a49acc37c0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\699b8843fdfd30e4b8ba50a49acc37c0_NEAS.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\fahik.exe
  "C:\Users\Admin\AppData\Local\Temp\fahik.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fahik.exe

Filesize
32KB

MD5
f6e7f90ffc8a7b6f0467a060785d42cd

SHA1
6abe924f21e410b9ded02092540814566327dd61

SHA256
7e28b35be9b313687130cd5409a7e03bc2dc592f89de1e2073165577c22ebf4b

SHA512
329b41fac46957d468b20c0ca3e73ad55f981a31d6fafe08452ffe7b390ffee81b74c738922645964d0ca0a6397be15316d3642531875b426559938c0e3f8379

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp23.exe

Filesize
13KB

MD5
5399eea307281f83e976b7c61cea4bfa

SHA1
2103febff76953a202036c9e4e44a93d9ce03e19

SHA256
da9bd7ad3d80aee176bdad07ba955c710aaf4202239d02ba443b99bf13be2b5c

SHA512
8b5f3845e86bcddd5841a44bce8f3fd1fc6ca616adf5c9ba5618fd186bf2ee3e0b79e2e2e5979f8506a14f84f949d4bdafd218f4e9c78bf0a8dab6e420302ee2

Download Submit
memory/1972-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2756-1-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download