2e35f1767d54a88658591bcf958cf72caf4500d5c803c551052e3194a4299432

Analysis

max time kernel
133s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe
Size

159KB
MD5

b6bc1f927a099e8a5092dc71f346d620
SHA1

261c1a4ad4ab811628b9a96d6051cc923b74083e
SHA256

2e35f1767d54a88658591bcf958cf72caf4500d5c803c551052e3194a4299432
SHA512

04584d2d68815354a4287d673294c99ee27404e19ed835fae205174c5f278f1f7649e07bf17e0590711668c9cee14e2ea79406c1b07c4d469846a9dc82f0c4f6
SSDEEP

1536:8iVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGJYwYcDp:nVlUPZRxfxE9Vs5cfdd6YGGIF

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2660	1436	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	90
PID 1436 wrote to memory of 2660	1436	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	90
PID 1436 wrote to memory of 2660	1436	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	90
PID 1436 wrote to memory of 1528	1436	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	91
PID 1436 wrote to memory of 1528	1436	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	91
PID 1436 wrote to memory of 1528	1436	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	91

C:\Users\Admin\AppData\Local\Temp\b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
159KB

MD5
06339c6c70932935de4cc3591da66f92

SHA1
f2f268ea5e17d377d981ee2797b0f7291c35bb3a

SHA256
05c563fab694da131f9eec0f0405a081aa49cdbbb82764271fe518c4fa1b1867

SHA512
586b440250d115fc61d8ee7484d9eba325dba1b949e8cd4ed33f3ac48a4f88045fc4926a9f50e6dcbf3ffbfcd50ebe53a88b29b1d6b6007feae1730681da102a

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
286B

MD5
40b13f0286f3458c05288653db628d71

SHA1
c4cd9ed6086ad518f45aa3ee4e1b406c2e38bc47

SHA256
e0f361aa04d9680e76035e631d8762094379d454ce4882c7a234e146a1152cbf

SHA512
f156b6775b8410ad628607c253f5ec138f73ab708d7fc37cafa2191806ee27ea50bc6f8aa4519659cc6abc7689801607229d178b3094f795f4cc855ed89f3d95

Download Submit