Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 03:15

General

  • Target

    5997fd3e495391cce6e94d8d3b844670_NeikiAnalytics.exe

  • Size

    88KB

  • MD5

    5997fd3e495391cce6e94d8d3b844670

  • SHA1

    6f4999d02e884036e5aeb8be70ea2b4fd9b1539f

  • SHA256

    20c85e45d2b08014abe0c8593a8923c177d7ad2270d5c4986aceef7fd1a85862

  • SHA512

    8df5c6af6b7add18aae96074e0e2c025f685920f2948e6498f9a23e47583cec24e5d5b4cc19765bdcff5af85fef985ce78a5b3b24f6a6992c0d85885ab32fe0d

  • SSDEEP

    1536:sajBGIQ/JDHKa5LJW6/Z2NZQKvdmNmS/:3AI8DHKuFOJvdN

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5997fd3e495391cce6e94d8d3b844670_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5997fd3e495391cce6e94d8d3b844670_NeikiAnalytics.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Users\Admin\pooeyog.exe
      "C:\Users\Admin\pooeyog.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\pooeyog.exe

    Filesize

    88KB

    MD5

    039b6dad55a7914ece02b50237e36f4b

    SHA1

    0411ab64dbb813ac461a326f6a55d461b44e4741

    SHA256

    5e8460939176d90d5f3b72b287d49604463ccd9f7cb12066568cfad4add904fc

    SHA512

    f3053f6ac77bf6d3574058b23ac4b3345f401b040e00750c40cc3d8cad8b4af4977edec90567820b96322b589d3460e550b3382a20065555b8edd3b2163115e7

  • memory/2328-0-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2328-37-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2504-34-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2504-38-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB