cccc268ff52e2124503f17c80c9cb5939754744bff2191ca68b85acac15c2a36

Analysis

max time kernel
149s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b71823af7c346f63f1c06bed5985f500_NeikiAnalytics.exe
Size

80KB
MD5

b71823af7c346f63f1c06bed5985f500
SHA1

bfe61271c9c1d0b805e668019339492b1c8c2f9c
SHA256

cccc268ff52e2124503f17c80c9cb5939754744bff2191ca68b85acac15c2a36
SHA512

cc48cd29651b44aef184e303b1e9f7d4e4c25064022f8025c5662519548876620b42f5de6e2d440ea158e0b2ef3232a64623f06316f9d6bf4333782153928a80
SSDEEP

1536:24Bobv7ZhMRxQrXKJRHahjAqSI1y03Sx4:/Bo77Agb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	b71823af7c346f63f1c06bed5985f500_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2440	zbhnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 2440	5060	b71823af7c346f63f1c06bed5985f500_NeikiAnalytics.exe	81
PID 5060 wrote to memory of 2440	5060	b71823af7c346f63f1c06bed5985f500_NeikiAnalytics.exe	81
PID 5060 wrote to memory of 2440	5060	b71823af7c346f63f1c06bed5985f500_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\b71823af7c346f63f1c06bed5985f500_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b71823af7c346f63f1c06bed5985f500_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
  "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
  2⤵
  - Executes dropped EXE
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zbhnd.exe

Filesize
80KB

MD5
8e876fe3aeb8877f760e27d5a042a815

SHA1
f86984c52d37b2f1ccc0f5981cde32fe6f3a4aad

SHA256
a65fd211cd85f2905817317fd77f3801c0da5d22e9a975610d9cc0a81f2fb3cf

SHA512
f8e98e0fbf5de3dbea2e8136d6b1a7e0c446f85ebb0a82c8c6e16931da4fc7e389a6b9b56cdf939097b893bf979daba3e060fdf51a2cf5000a7dc6807878d3a5

Download Submit
memory/2440-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2440-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5060-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5060-2-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/5060-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download