12c0ecef9899c2e19423283fa343a3eecfbe75ece71247fe92f38a5754244798

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

458baada55e53a17210065b36bdef190_NEIKI.exe
Size

403KB
MD5

458baada55e53a17210065b36bdef190
SHA1

30d0da757c1d9bc705f81c0c777d91a81b9cfb84
SHA256

12c0ecef9899c2e19423283fa343a3eecfbe75ece71247fe92f38a5754244798
SHA512

e2e26206f4656947c00b9c4f2d2757a99966a9dc196e6dba3edf1ede026bb49aeedd629a03e79fb032f63161807c190d5f8ce102bf2c1a1e32211d60be97b893
SSDEEP

1536:oXBYjfC24mFVsIgvo3X4iZpTha5VlA8mx7aoL83YTjipvF2PL:oX+0mFmIgvo4iZhha5rEaoL83YvQd2T

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	458baada55e53a17210065b36bdef190_NEIKI.exe

Executes dropped EXE 1 IoCs

pid	Process
3292	jusched.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\6593bf28\jusched.exe	458baada55e53a17210065b36bdef190_NEIKI.exe
File created	C:\Program Files (x86)\6593bf28\6593bf28	458baada55e53a17210065b36bdef190_NEIKI.exe
File created	C:\Program Files (x86)\6593bf28\info_a	458baada55e53a17210065b36bdef190_NEIKI.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	458baada55e53a17210065b36bdef190_NEIKI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3292	5040	458baada55e53a17210065b36bdef190_NEIKI.exe	90
PID 5040 wrote to memory of 3292	5040	458baada55e53a17210065b36bdef190_NEIKI.exe	90
PID 5040 wrote to memory of 3292	5040	458baada55e53a17210065b36bdef190_NEIKI.exe	90

C:\Users\Admin\AppData\Local\Temp\458baada55e53a17210065b36bdef190_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\458baada55e53a17210065b36bdef190_NEIKI.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\6593bf28\jusched.exe
  "C:\Program Files (x86)\6593bf28\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1876 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\6593bf28\6593bf28

Filesize
17B

MD5
bff3d8f76e182194c4a2abf1aabba9f3

SHA1
07e5b604bb505a800b3e0ac16fee483b70595768

SHA256
6bc8a4f93eaa1b3e7cfa696855bf6a852cf6555d694bc03e337261a27e58246f

SHA512
0c5def3bb01ed166d4135190e131c27be4b6039987e269b6c3fca07677b3c637868397f207df631a098182a6bd3c795e6dd34541f82c5ecd6062441af0af7f50

Download Submit
C:\Program Files (x86)\6593bf28\info_a

Filesize
12B

MD5
eb56128b3003fdb13608982c217d835a

SHA1
8ac201989edf70869b5c8936bf1bbcd9350ebd5c

SHA256
bd40e5330ac9e3d4a6b06634de97e14068b47705c6b8cfdd59e02c5b7760d1cb

SHA512
143523a02bec100ba4d0f7b11f1581ee10f5c8fc6cf8fbf1e16288b41e2955a15e6afeaff428760052b17eca48c17bd4aeaf6b0cde35134d7c8de8e180859677

Download Submit
C:\Program Files (x86)\6593bf28\jusched.exe

Filesize
403KB

MD5
98b70889a060cc9993f51134156e58bc

SHA1
31de49d76f80af495bf0bb06a77ae39772e6ab8f

SHA256
7cb8b5e59c7e233c30861651d4ee39f61bdfd858df60045bae945b717cb09a4b

SHA512
e1ec80993ce3b950f856a954c59e0623f6f63988c6c897274901b1862dbfde59c2a25a5a2493c1e1d78ebacc992eb22432e2af46951d43b2b382359efea7316f

Download Submit
memory/3292-15-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3292-19-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/5040-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/5040-12-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/5040-17-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download