135f68fb08d6b90b4b86524e7fb3ae30b9f21fe20471c66d2d176c4e4840e163

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
Size

90KB
MD5

39627cab2e69713eda6c66a73b9dc730
SHA1

992e6083bbb0de9c69aeb10e81553b1b2607a264
SHA256

135f68fb08d6b90b4b86524e7fb3ae30b9f21fe20471c66d2d176c4e4840e163
SHA512

c28b61b824fd48534ee3b86e7670404d72d9a38eb35b7dd5938caac7d45e1cc94702322f3a782258134f120caccbb591d7fd25f35c11256c2f48af808680c554
SSDEEP

1536:lDcfLfeb5Ep1FzgyXVdtnVHNWnnn6maaaBrrrM++++Y:lD2LNnFzgyXVd1Beaaaj

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1444	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4044	zcihost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zcihost.exe	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zcihost.exe	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zcihost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zcihost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zcihost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	444	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 1444	444	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	81
PID 444 wrote to memory of 1444	444	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	81
PID 444 wrote to memory of 1444	444	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	81
PID 444 wrote to memory of 4680	444	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	87
PID 444 wrote to memory of 4680	444	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	87
PID 444 wrote to memory of 4680	444	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1444	attrib.exe

C:\Users\Admin\AppData\Local\Temp\39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\zcihost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:1444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\39627C~1.EXE > nul
  2⤵
  PID:4680

C:\Windows\Debug\zcihost.exe
C:\Windows\Debug\zcihost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zcihost.exe

Filesize
90KB

MD5
2eb52389e0f18a3731f527b77c7a12eb

SHA1
fce5b91b8d2699f65fc1a373f4f70c41fcb8c87c

SHA256
60ff3d3389340bd6b59688e07a6124d57db21abd73bbb0f68f615bf777868f87

SHA512
f9fbedd76106a7a644fbfccdb68d9e92488916f665cf18e0e298701cee6e294f55eb64ec38d593de8a3866505ce6fa1cd4fc2459a37ccc9eb450759f0e2bc9fc

Download Submit
memory/444-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/444-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4044-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads