c2493d3a2eb508f0d7e1f6735f55edd1c3674e6ba2a69307de451a318d25e699

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe
Size

47KB
MD5

2e45ddc0688ee9b835f0e4ca666fdb60
SHA1

d15779690d5bc3be0e5c4dc52fe0b0c1e97904ab
SHA256

c2493d3a2eb508f0d7e1f6735f55edd1c3674e6ba2a69307de451a318d25e699
SHA512

658ae2ddd9eb209361a3ff260ea03587969a5328e13bb5721b2ae9347450bd550bf765ff16358fbdc368b3427a74115f51af73b161a0cc9385d7208a54178737
SSDEEP

768:jvQ5qDLHRdw2iPSMEk/6KxPEMb960yXb8Fq:jvQoLHjw2iWPKxP7vyX40

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4996	rgkhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rgkhost.exe	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\rgkhost.exe	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1408	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4828	1408	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe	86
PID 1408 wrote to memory of 4828	1408	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe	86
PID 1408 wrote to memory of 4828	1408	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2E45DD~1.EXE > nul
  2⤵
  PID:4828

C:\Windows\Debug\rgkhost.exe
C:\Windows\Debug\rgkhost.exe
1⤵
- Executes dropped EXE
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\rgkhost.exe

Filesize
48KB

MD5
dd9c82408c30d47ebaaecbd0b3b4080a

SHA1
b09694e05b2561d678591b114a331b95a54ba90e

SHA256
8fb1540f90a58f7ad011ee744eb85f88405a5778aff2fdb3606e7406ff0ce399

SHA512
f58dbc46bbf73b127fa49b943275796c581a9c155bbdeae912e1928922148f58a5d84a42851d0d19aa4e72b5f2464b53424ffbba81c10ef14fc3aaf04573ed58

Download Submit