eb33b8fdf4db107477c2373fbb00407fd91a18d4ce7fa21d89f77cc1760ebb0a

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe
Size

33KB
MD5

68d4b9c069acbc49cd8619114abd8100
SHA1

bc233adfa9e0c4be7048adb02164e85ca6ac6cfa
SHA256

eb33b8fdf4db107477c2373fbb00407fd91a18d4ce7fa21d89f77cc1760ebb0a
SHA512

8b92263780c794d79f741f33ccd2984719e06c103bda1e3c00705ceee402177bae0de17f00a6485f45c760727c09eeaed92651747945250ec24ae96223714081
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStEkcsgROA:b/yC4GyNM01GuQMNXw2PSjSKkcJRb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1788	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1788	4076	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe	82
PID 4076 wrote to memory of 1788	4076	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe	82
PID 4076 wrote to memory of 1788	4076	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
33KB

MD5
274eb5f010b6c1311e94efce19b50bb6

SHA1
cb2f635103ae585da2c5293f70e77beb22b4fada

SHA256
e90208715ecab8a648587a53aa6cb1d9fc7bd26c578c34689343151370943314

SHA512
fe5c0842dbb56ccd006dc26326ce121cf5a3debeb1a7aad0c57afd1b7d4558ab93e73bc64ea598e677dc2beba7c9d4bfa4c5c1a675489a97af8bacdb7f285227

Download Submit
memory/1788-25-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

Filesize
24KB

Download
memory/4076-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4076-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4076-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download