Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
-
Size
92KB
-
MD5
01fd4daa9eaf6bcc9cfaa37efa2f3430
-
SHA1
fddfd69cb7fdec778088ed568656103c62c3e85f
-
SHA256
8e421dd3424223564c85b6f2c8d4db7e616669f24e2ced5cafe96d69a83f8e94
-
SHA512
fcdc4890fd25dd58648a0d6602ca130f2c61efcce12f31377b3cb2955758491e7fd1fbae5b4a1a060fffe9028b2568a443450abe189529b3bd7ba4de9350ab87
-
SSDEEP
768:54pt1NSf7M9Syk+IAnTjwm41tYhZV6pudcMiDh7FOaRb8RC1J3AFLT7Dm3UIn4Us:OVNSf7hyk+I6412V6PMqAax80XAFSrR+
Malware Config
Extracted
urelas
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1688 huter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4964 wrote to memory of 1688 4964 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 88 PID 4964 wrote to memory of 1688 4964 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 88 PID 4964 wrote to memory of 1688 4964 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 88 PID 4964 wrote to memory of 3900 4964 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 89 PID 4964 wrote to memory of 3900 4964 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 89 PID 4964 wrote to memory of 3900 4964 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
PID:1688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:3900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5d8c69e006046149f40585fb3e1bfafb4
SHA197073fb1d116248dbecd009e4bf873ab45c6c2da
SHA256df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228
SHA512b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9
-
Filesize
92KB
MD5684f34226d1c582436a1caf5ffbede20
SHA1f7f8603176bf0eb6ee8305e385d706e9df283b6d
SHA256c77c1b9fc89a0bf7434d69586fdcf672ac07611cc1d915e0ff17fc8eb703bbb5
SHA5125934251703861616d2b2812416fc5d2bace7aa277964fc6e48e72299b7b337fe672c60f080b7b3ffcc97a7e9dc428bd97358ee2fa16919ebf3034968c7a59a5b
-
Filesize
304B
MD59b6e321710b30ad900aa92e5cb30d191
SHA1e09bf7d2dc2af6b1ac030c9853a9639582c26888
SHA25684fd1df0d46564fafc29f3ed7b9e1fdf0f02dbbdd80166c1a713c4519c114f28
SHA51242d07d99d6d6e80bb85a7e09b5eb374b727182af1ee44b7893367d4406eb751b61a28ad2591be9f0cb455dd6849a1e90f3b20ef210079be89eb951e4aba31a7e