2f0529a59e0c5f55137ce1099986d782e3cb6a81836e82e86dc8b06734ac0760

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe
Size

134KB
MD5

2371151009803f6aa7798eaa7f970380
SHA1

af21717501fef7ccf8ea595a6ad573624ee5258a
SHA256

2f0529a59e0c5f55137ce1099986d782e3cb6a81836e82e86dc8b06734ac0760
SHA512

4296a3aea829a5fab350259dc254f8a90096b0f11e154714d1331f24081dd80f84cba54522b32300fc28a9b691a4f9ad0e5fe93e248cae3ddd65da3344e39bd9
SSDEEP

768:ezQYScGqIuAHuYtvdxwYHw5FAe2QNncwxctH2NM3qm9IFYPRBrd8qFKOTM:4QCIuAHy5wQNacM1WF0BrKqFKOTM

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4280	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\b7ecb59d\jusched.exe	2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe
File created	C:\Program Files (x86)\b7ecb59d\b7ecb59d	2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2472	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe
4280	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4280	2472	2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe	80
PID 2472 wrote to memory of 4280	2472	2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe	80
PID 2472 wrote to memory of 4280	2472	2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe	80

C:\Users\Admin\AppData\Local\Temp\2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2371151009803f6aa7798eaa7f970380_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\b7ecb59d\jusched.exe
  "C:\Program Files (x86)\b7ecb59d\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 700
  2⤵
  - Program crash
  PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2472 -ip 2472
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\b7ecb59d\b7ecb59d

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\b7ecb59d\jusched.exe

Filesize
135KB

MD5
1a37c87d33ca3505310a5d86ad196336

SHA1
6b9317f27ba2b4cad62876f4e8b679fee0ee83c9

SHA256
48119329e837565d326eeb802b3baa33afd5bee2138e62fe6b022df279798a12

SHA512
1e2d61fb7156bde1cddce950c982db200baab1cee571c119a5ccc916b7637e68bf7e115c12a5f2e15f2b5da00b4780b06ae4e8c0ef33bb4f3a810ce86feae9e5

Download Submit
memory/2472-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2472-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4280-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download