a6ff6b46c8c18c8667f626aad0a12a4e6b4593f380a19aff65df1aea84ff2b76

Analysis

max time kernel
133s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

437d56ad1d0d5db30a200b972f904020_NEIKI.exe
Size

73KB
MD5

437d56ad1d0d5db30a200b972f904020
SHA1

220efb25afb2031bdaedb6e04bd8d3cd972ccf1d
SHA256

a6ff6b46c8c18c8667f626aad0a12a4e6b4593f380a19aff65df1aea84ff2b76
SHA512

5738bbbd716145e3c9101b23054ecfb177a3ad957ec1c822d78735b7a84b6201801a948ffd870161961dce847b7281ea53abdc536190de3fb594b8bfee73222b
SSDEEP

1536:4LbwC+enZ4A/5ldZ9EdXFqRcGWUmRxd01Ml6tq7ULPmq/:QTnZ4wAXAvjmHd0gs9p

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	437d56ad1d0d5db30a200b972f904020_NEIKI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3236	3920	437d56ad1d0d5db30a200b972f904020_NEIKI.exe	87
PID 3920 wrote to memory of 3236	3920	437d56ad1d0d5db30a200b972f904020_NEIKI.exe	87
PID 3920 wrote to memory of 3236	3920	437d56ad1d0d5db30a200b972f904020_NEIKI.exe	87

C:\Users\Admin\AppData\Local\Temp\437d56ad1d0d5db30a200b972f904020_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\437d56ad1d0d5db30a200b972f904020_NEIKI.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dfz..bat" > nul 2> nul
  2⤵
  PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dfz..bat

Filesize
222B

MD5
20f35cde300537a2a86cd39a16f3e4f2

SHA1
52b31ebc880e90e5f9dfa2a9c0dddec6bfdbd984

SHA256
26ac8eebe5ba246ee8dbb8679342c4762976b0af62456ed29404e17a49e65975

SHA512
a563731fcc1e8057a731fd40a252fb056216c5ce46f43fa12c8bd74278b0cf33390aec89ba8e65f67cd24d76e3368d510eaef5cb296e18e4547328ef2a9d0b81

Download Submit
memory/3920-0-0x0000000002040000-0x000000000206D000-memory.dmp

Filesize
180KB

Download
memory/3920-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3920-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3920-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download