e50e940dc06486badc4160aae5bb9cb011b1603557213c045fa6a108c389e6d5

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0c4f6f87c6a0f932e9fb7d19000ebb0_NeikiAnalytics.exe
Size

22KB
MD5

c0c4f6f87c6a0f932e9fb7d19000ebb0
SHA1

a3bec53c47cc05c5a340e0fcb157f3c594efe133
SHA256

e50e940dc06486badc4160aae5bb9cb011b1603557213c045fa6a108c389e6d5
SHA512

545d0f58568e07cd1a1cf6384dd5f6cf84e36a8ccb854531a298c28e30b071210bca2f9e9f1c735cd8ccf8290a0f840f32a66859f0226c474adfbac26b86d4e3
SSDEEP

384:yqdPNOCoP7/+6xr2wbSp2EA5PdR8uzeN+uiVWeqyOrv:1qCg66x2wbSp2EY6ueiVWz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	c0c4f6f87c6a0f932e9fb7d19000ebb0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1656	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 1656	3472	c0c4f6f87c6a0f932e9fb7d19000ebb0_NeikiAnalytics.exe	91
PID 3472 wrote to memory of 1656	3472	c0c4f6f87c6a0f932e9fb7d19000ebb0_NeikiAnalytics.exe	91
PID 3472 wrote to memory of 1656	3472	c0c4f6f87c6a0f932e9fb7d19000ebb0_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\c0c4f6f87c6a0f932e9fb7d19000ebb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c0c4f6f87c6a0f932e9fb7d19000ebb0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
22KB

MD5
87a48da05b4cfa484d9470329dad2f7e

SHA1
4f266c8d958213df2707fbed64be444dcab92843

SHA256
4f6a654dc5f66096a44351180f2d82e1eb01098759a62e85c452e6108d160a64

SHA512
078d44aecdf81160872539352eb8b57759f913d1d03d0be1eaaf4d26b10bff3efaed542d17cf84e1ab2e801ffaf165c6e516bfbde2d625cbec7512eeb2a9c4e4

Download Submit
memory/1656-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1656-15-0x0000000002610000-0x0000000002A10000-memory.dmp

Filesize
4.0MB

Download
memory/1656-14-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1656-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3472-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3472-2-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3472-3-0x0000000002660000-0x0000000002A60000-memory.dmp

Filesize
4.0MB

Download
memory/3472-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download