0e65558309f74ed55f3178c4d7fa828321c31c524b9e50037bbe8e5b4b56c697

Analysis

max time kernel
123s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cbff7b70537f4a4da9db7824cc6a150_NeikiAnalytics.exe
Size

31KB
MD5

1cbff7b70537f4a4da9db7824cc6a150
SHA1

f2b374679f79411e7f22db7996817f805b8016be
SHA256

0e65558309f74ed55f3178c4d7fa828321c31c524b9e50037bbe8e5b4b56c697
SHA512

3327cbff97dbbc64afb70ccead9eac7dada09bb07e05c9529db962bdd1ed58969ffdd9a3fee09f10a0eeec922db9bd4a38dd6e524b0c3c29932347d8df9fb896
SSDEEP

768:WBz/vjmTfG4LJjBaECkegSi7xsYhaKDvdpv8M/s76z1ABPrk1:Kz2u4LJjBaECkLSi7xsYhaKDVm97+1UQ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	1cbff7b70537f4a4da9db7824cc6a150_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1796	opera_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1796	4884	1cbff7b70537f4a4da9db7824cc6a150_NeikiAnalytics.exe	83
PID 4884 wrote to memory of 1796	4884	1cbff7b70537f4a4da9db7824cc6a150_NeikiAnalytics.exe	83
PID 4884 wrote to memory of 1796	4884	1cbff7b70537f4a4da9db7824cc6a150_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\1cbff7b70537f4a4da9db7824cc6a150_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1cbff7b70537f4a4da9db7824cc6a150_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\opera_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_updater.exe"
  2⤵
  - Executes dropped EXE
  PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\opera_updater.exe

Filesize
31KB

MD5
4240c6590ab74581e573bd7efa795ffd

SHA1
d1fc75dd01a82ae49851556860cc4c3401bc4543

SHA256
4df2d98b6f8c967584381412d73591d3c5609a15a0abda5315000277b41d0970

SHA512
5c8f79b1bf2904f22271a91e8a4369e63baec75f2ffcd1e6afba65796bbcccb7b4be87e8abb8c4180ac68699eb4405079f43e5ceef3a05c82f15c9ba1a7fb2a7

Download Submit
memory/1796-9-0x0000000000091000-0x0000000000093000-memory.dmp

Filesize
8KB

Download
memory/4884-1-0x0000000000141000-0x0000000000143000-memory.dmp

Filesize
8KB

Download