6eacd5221753b5c2846d49c4eb8475f620e53f829aa231a8eda1ed4a400d9a94

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe
Size

92KB
MD5

2362e1eb155a1f3471a43d6dcbdb7da0
SHA1

59d8e4a19a2692354fc7a5761488cebb61c8f047
SHA256

6eacd5221753b5c2846d49c4eb8475f620e53f829aa231a8eda1ed4a400d9a94
SHA512

1ce28e0d2ac1eb637388de06871821a975379428151c597b0d889cb60660e7eee32c72d40a94927820103ffc794b23a4ed92ee32698fd4f212143907e6278365
SSDEEP

1536:8QOr++vOxt0c5hfHP1qlmv60lHj4UraTPVPSPkP4PjPAkbohaWdV7lObdEZxHwAf:2rFA0c5Olmv60l3LbohaMAuwiNCP7s

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4252	yiaeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3976	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe
4252	yiaeb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4252	3976	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe	87
PID 3976 wrote to memory of 4252	3976	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe	87
PID 3976 wrote to memory of 4252	3976	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\yiaeb.exe
  "C:\Users\Admin\yiaeb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yiaeb.exe

Filesize
92KB

MD5
5bdda815e462649809f2874902679017

SHA1
a4c0016716fa2272f524883293fbc51ab8c4452a

SHA256
4c1f7d3a3c1950005194bce5f39ed910e4617551b23a8d8a49f41a23908f6c12

SHA512
b03116e3587497a949274c163df2db3090e702b3b9b28b7b4285c1914d514aa359f25043e52a14ae618324c5f4be7a80d857527ece49c25a555916b214c55346

Download Submit