c5c2ad315ecb44dc38f5e687fa9b8a23023e984ef31d1514cd211e81bccd7ea6

Analysis

max time kernel
149s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe
Size

34KB
MD5

ae231849bc431244b466e9016f4cfdf0
SHA1

cb2588d7a5ac1c727d011893b0c7aac041122d05
SHA256

c5c2ad315ecb44dc38f5e687fa9b8a23023e984ef31d1514cd211e81bccd7ea6
SHA512

4602d8d9ff6e6a4e337f3709491a50672448a63af5b8acd5b4c2e2de94d7600feb5ea41d9ec012ccbdba773f0f1d64384b1e0824b508d97d86cb7329498c0022
SSDEEP

768:6B7HBXFw82t2C80lyaZ4jX05Rftleo9LXm4g:u7HZFwzlyaZTNAaG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	cnwog.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2708	4712	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe	82
PID 4712 wrote to memory of 2708	4712	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe	82
PID 4712 wrote to memory of 2708	4712	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\cnwog.exe
  "C:\Users\Admin\AppData\Local\Temp\cnwog.exe"
  2⤵
  - Executes dropped EXE
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cnwog.exe

Filesize
34KB

MD5
2afac02dcab6e571bd39d1652784c170

SHA1
a81eff8dd648c0daa43cba77cf6daa3d9cb2cd69

SHA256
d52d0a7b1e6ee05a6badc04d4b271bb59588c906c1423a0545178abcb5f91a8b

SHA512
d51c635c2f506d68022d5b4602da478bb956d44db06728de7cb86c03c81fc2008a109f5d9db136ae9a52ec22c0849e1986b3a376d3264d4df359d0da007d4368

Download Submit
memory/2708-10-0x00000000023C0000-0x00000000023C3000-memory.dmp

Filesize
12KB

Download
memory/4712-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download