3815340dcfb559d0caf5c15562bc39712188edf34e2d2694df4caa44a3adb5c3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe
Size

6KB
MD5

7fea26e0af658fadab360b27963a0880
SHA1

45f346728046deb8ce124dac491415f5dab18126
SHA256

3815340dcfb559d0caf5c15562bc39712188edf34e2d2694df4caa44a3adb5c3
SHA512

4433c93685ec80368418f50765f306675583fd13e64c01ebe4e9322fc3718cbaa7d607d7032acd96303f07591132e342497292bf0c51b3ff16ea5c820ecd2446
SSDEEP

96:DJOqSXslYquHnnwR2UM2ClAhxnqXUBuYX:XS8AnwR2FBAukNX

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4856	huty.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 4856	2812	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe	83
PID 2812 wrote to memory of 4856	2812	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe	83
PID 2812 wrote to memory of 4856	2812	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\huty.exe
  "C:\Users\Admin\AppData\Local\Temp\huty.exe"
  2⤵
  - Executes dropped EXE
  PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\huty.exe

Filesize
6KB

MD5
ac1580d6343ecf0e4881c06e3a3a988e

SHA1
ee5a12ac64216672adc20b2419120cc4fd5745e8

SHA256
5a571a0b68d678473daea4a3651040b66cc37ed9f750c69908cb9095dcea0b02

SHA512
3c380ebf8556b3375712d2164520061cb627b76b922c8d0466b9db397122d3e5652c6253baab44942dd02e48522598e5e250007186219ba9a2a54d7c43774a88

Download Submit