1a70bf587b1ea475c9e1f55dab2357f910f586f5d782beae2e4f1763130ed2c9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36494733feab51593bacd33f315b8ce0_NeikiAnalytics.exe
Size

48KB
MD5

36494733feab51593bacd33f315b8ce0
SHA1

95cf297a6aa692973c79f5b46ea4c6acd5ed1cdc
SHA256

1a70bf587b1ea475c9e1f55dab2357f910f586f5d782beae2e4f1763130ed2c9
SHA512

8cc14fdb7b5cc4a57329ad533a7955be61ab923e693d2c8b0cff1a6a5d300d01092a98ced2b69c53f6c0f6ac411fd70d3483dfbacc6a90aec4617c1fa9f8dc86
SSDEEP

768:oOY2HJSxb3HXBQFKV9V/vbwaoiuAioMKf:oeoxMKvV/kaI1Kf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	36494733feab51593bacd33f315b8ce0_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	hfdfjdk.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	hfdfjdk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2744	2832	36494733feab51593bacd33f315b8ce0_NeikiAnalytics.exe	84
PID 2832 wrote to memory of 2744	2832	36494733feab51593bacd33f315b8ce0_NeikiAnalytics.exe	84
PID 2832 wrote to memory of 2744	2832	36494733feab51593bacd33f315b8ce0_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\36494733feab51593bacd33f315b8ce0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36494733feab51593bacd33f315b8ce0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\hfdfjdk.exe
  "C:\Users\Admin\AppData\Local\Temp\hfdfjdk.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hfdfjdk.exe

Filesize
49KB

MD5
1ad4f1f3234e7f96c1a1b6f583090f24

SHA1
b999b2d8f84725c519d68bc42d61fe6f5b177302

SHA256
e1fac08428556eeeec983c169d83afd3f0edfdc130d750b1182049795a588bb8

SHA512
c41305bca68bab5ff00b3434e862a5d583bf0d6f45c30662212c3c8511e08ff2ea3acf0770b4e72cc09180c39c268299883bcb8cd05af14356686d7033a22cd2

Download Submit
memory/2744-9-0x0000000001800000-0x0000000001804000-memory.dmp

Filesize
16KB

Download
memory/2832-1-0x0000000002780000-0x0000000002784000-memory.dmp

Filesize
16KB

Download