Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
11/05/2024, 03:50
General
-
Target
73e1f37f4a8d47f433a1e1c19ec46d50_NeikiAnalytics.exe
-
Size
42KB
-
MD5
73e1f37f4a8d47f433a1e1c19ec46d50
-
SHA1
2108d0777db4b543096dc4dda4fd1124c39ca8d6
-
SHA256
bdcce21ea0efef74d25ffe7a659fb0f338e66f63a935020bdc2a0b509e642881
-
SHA512
293a50f09f9419584ba33a5c46c531a532ff3aa578850578e8d40b7ee59528b56808e12b0d6531caa900174746bdfe4997bf5256ebdfaa6e589bc88327a1005a
-
SSDEEP
768:xIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77DPQ1TTGfGYh6KZq:xI0OGrOy6NvSpMZrQ1JBKZq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73e1f37f4a8d47f433a1e1c19ec46d50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\73e1f37f4a8d47f433a1e1c19ec46d50_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD553f57f3e4318dda5a842a62fa7a1102f
SHA1cda164388116b7bfffb309152ce53eb91ea01237
SHA2565a189f6b3af8db083ae136a453c56f4655d7f16d1d94b64a78d281f5e166bb86
SHA5126a3b3a52d5a41cd2057f9b6e32e9743c27672ee72eca5ba958ae5a0878157ea06d19d7b0f916eda6b84ffb9cfc7e34cc47ea195ea6697a4d395742fadfec6470
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB