356a85cad285d3f131ed487a7f82ed79817697f4a5177140fe3dcfd54dd609fc

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe
Size

88KB
MD5

33c578f06438776cbad7db5842a864c0
SHA1

4f379764693368ba7dc59b8c5e84d81eb49a950a
SHA256

356a85cad285d3f131ed487a7f82ed79817697f4a5177140fe3dcfd54dd609fc
SHA512

f4a336553b1d85ba475a7d28762442bf555b106e873fc84b44faf7f6a10751baefeba17b100167dba6273aa28ad6853851b44299b5a87775f63aeb310abda4af
SSDEEP

1536:jvQoLHjw2iWPKMvw71AEMnyXBM/XXXdwVRbvXXXh+Nf17RCXXXDrXXXDKXXXmlGQ:jv5Ls27BIJAEMnyXBM/XXXdwVBXXXhYy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3872	zcihost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zcihost.exe	33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zcihost.exe	33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2156	33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4484	2156	33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe	86
PID 2156 wrote to memory of 4484	2156	33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe	86
PID 2156 wrote to memory of 4484	2156	33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\33c578f06438776cbad7db5842a864c0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\33C578~1.EXE > nul
  2⤵
  PID:4484

C:\Windows\Debug\zcihost.exe
C:\Windows\Debug\zcihost.exe
1⤵
- Executes dropped EXE
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zcihost.exe

Filesize
88KB

MD5
60842c6bb79a22eaf655db34afdcbaeb

SHA1
054b145b22d3201cd886d3e8f51e3598903cf156

SHA256
8b08357fce4fe42a9ecc1b60b72de55e2e83037948434b255fef2b1f4764105f

SHA512
93f62e0eb8a17aa565b6dd7a22374818bdd03f9cbef8248d2f88afeb6beb2450aa3ad3e81cffab76e0e7b9106d10503957d36f99d5b599d14c4808c91a33d14b

Download Submit