534a918fcec63e8aff5cdb6c8ec5d010f886c7d58acec5c7187ab99f98ff9997

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe
Size 78KB
Sample240510-edtwbace25
SHA256 534a918fcec63e8aff5cdb6c8ec5d010f886c7d58acec5c7187ab99f98ff9997
MD5 62dee00473980bb8cbca09ed4d635110
SHA1 60dbe6a03c4cae82d2d3a4e83e06aa2a51689652
SHA512 5aa80c361c93c64fab22cfd27f008d35c5850cd6a3338744cac0f8f74ba1c1231328d89ea8bb5965815f441682db208809b8b2552636503e6cd9681efdd59bfd
SSDEEP 1536:sc5jSHdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96g9/C1io:sc5jSGn7N041Qqhgz9/Q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
1804	tmp45B4.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	tmp45B4.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp45B4.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe
Token: SeDebugPrivilege	1804	tmp45B4.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3492	2340	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe	84
PID 2340 wrote to memory of 3492	2340	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe	84
PID 2340 wrote to memory of 3492	2340	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe	84
PID 3492 wrote to memory of 2256	3492	vbc.exe	87
PID 3492 wrote to memory of 2256	3492	vbc.exe	87
PID 3492 wrote to memory of 2256	3492	vbc.exe	87
PID 2340 wrote to memory of 1804	2340	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe	88
PID 2340 wrote to memory of 1804	2340	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe	88
PID 2340 wrote to memory of 1804	2340	62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tplybu-m.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES467F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6780508145E24E089F48669E615BACBB.TMP"
    3⤵
    PID:2256
- C:\Users\Admin\AppData\Local\Temp\tmp45B4.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp45B4.tmp.exe" C:\Users\Admin\AppData\Local\Temp\62dee00473980bb8cbca09ed4d635110_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES467F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES467F.tmp
Size 1KB
SHA256 161a53b9b0af5da3458fdba7f8212e19ad8c4e9b0d94fd55722c08f1f71887db
MD5 884539808b44aae92b74a67e9c69f9aa
SHA1 eed6ebef3036c7604d41524a17b1df3afa98da6e
SHA512 d2f7a096dd5943c23866d3aae106407561d70c77f83a00e811d90e93bad64ab1f325ce9a6e39c4c88c4074ebcaa1e1e76b01fbdb059a28b16dc52485ad29aa85
MD5 SHA1 SHA512

Submit Download

tmp45B4.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp45B4.tmp.exe
Size 78KB
SHA256 4da7c59cc424ae46cf7ba752231e16c53a9550bef539e63ab0e55d2897765008
MD5 0f72e3da85ea7406b36163532699860a
SHA1 50884de563dfbb0457840292125bba49d776606e
SHA512 9eca373bc98de8525cd6210c02c65fbbb49ec2d89e9908777c3d21dd76164bd99c34f9fbd400840ed839705f447621d2736bc0bb8e61f2569032a5c688f00c8c
SSDEEP 1536:6PWtHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtd9/M1lB:6PWtHFq3Ln7N041Qqhgd9/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

tplybu-m.0.vb

Path C:\Users\Admin\AppData\Local\Temp\tplybu-m.0.vb
Size 14KB
SHA256 cd00aa358c011f7cbef6371104719ac59d39136f65a4b0e3b68bda84d882fb4a
MD5 1bf08da273087b73d94cf714307f8208
SHA1 5d004e9f38fa3eb54e5382940619fbc8fd8c3f14
SHA512 ac68bf473a1aefcf0b1a41b0ceb86a438a5e77ad8c20ccff8bed42db83b9a582bce16938921d51f40bc3d93c99006095ba52114b3bc71d8c734d09f87c8fff36
SSDEEP 384:r3NrN4oNuRNZVlniNgN3cHb+E6NLzN7QZSN7eP:ZZ4QurHluI3cHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

tplybu-m.cmdline

Path C:\Users\Admin\AppData\Local\Temp\tplybu-m.cmdline
Size 266B
SHA256 005231936a0823b2af58e6ed45a01bd0284ac05c1ad253d584e03468c7d84a7d
MD5 95c84c81feea8829876a59584243e47e
SHA1 382c393d0b96b5eb18b9c43e5be7fba0fba9c9f6
SHA512 461d0a24d7623beefab7e47c790c2c05e861ab95c68b82b00157b15cfb6fe6f1ae0a38847ad6feafda0f1dc24a2bf5c6ac34f124d227611224bc45a6eefc9287
MD5 SHA1 SHA512

Submit Download

vbc6780508145E24E089F48669E615BACBB.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc6780508145E24E089F48669E615BACBB.TMP
Size 660B
SHA256 7d4fdf4620698afe60ab712d5e77bc24b3cfceafbec2b68e507105c963e3ab8d
MD5 95dc174c5489a0dc8ad35b7558f56778
SHA1 33ecd88e518e1d94fad9ae0f6325d3ce9f5e974f
SHA512 d0c6cb46074db13d414def2129c053a1f8000afd39c52226407d61589bcb6155d00a5c30f7277e5ea5a57166b859acff5f8a35d7a99971d45b071c720ac6481b
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1804-23-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1804-24-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1804-26-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1804-27-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1804-28-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/2340-2-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/2340-1-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/2340-22-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/2340-0-0x0000000074692000-0x0000000074693000-memory.dmp

Download

memory/3492-9-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/3492-18-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads