9f077400847e5c2255655e850cb7f29c5fc54913cd7af34bb0dc9a95c795d8ba

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe
Size

79KB
MD5

ad0f56ac1f677feede083dce21b7f840
SHA1

1de7b2a11c6769bbe23b55c3fb4c28e30f6462ae
SHA256

9f077400847e5c2255655e850cb7f29c5fc54913cd7af34bb0dc9a95c795d8ba
SHA512

7b860e4a6b0eef53d4b36c89398b85e0c6eb3f335fe4a035d612fa0eb74e54070f89bbcd9cd5c49586b0b17afc9874a150d26cc37cba2e08cd996c7a65a46d88
SSDEEP

1536:bDcWLfIbgEp10gyX/dtnTHNWnnn6222229X:bDXL0n0gyX/d1re22229X

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2456	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3460	wmahost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\wmahost.exe	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\wmahost.exe	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\wmahost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wmahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3992	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2456	3992	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe	89
PID 3992 wrote to memory of 2456	3992	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe	89
PID 3992 wrote to memory of 2456	3992	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe	89
PID 3992 wrote to memory of 648	3992	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe	95
PID 3992 wrote to memory of 648	3992	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe	95
PID 3992 wrote to memory of 648	3992	ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ad0f56ac1f677feede083dce21b7f840_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\wmahost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AD0F56~1.EXE > nul
  2⤵
  PID:648

C:\Windows\Debug\wmahost.exe
C:\Windows\Debug\wmahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1324 /prefetch:8
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\wmahost.exe

Filesize
79KB

MD5
0656a98105b29ef83d7aa640ffb2688e

SHA1
50bd5367c92510e795b32ebdbf738d90d75e0255

SHA256
24eb7a157c20127189b378598ea94a604a1023da97c824317dd21623e5aaa352

SHA512
408c5cdd2b1f1b81c231af2a45db6b795c6d31e8f7fe44d5c04d744960b101ec9cf545b751f26b012a466e95ffead368466ddf19cf8a03749a50c8506d6e35a5

Download Submit
memory/3460-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3992-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3992-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads