c54901a3521a7f0590c848c71644cfbad1b1735206889d82706d0bf39973c184

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce1733d0475b53ab7e6608c4016cf8f0_NeikiAnalytics.exe
Size

77KB
MD5

ce1733d0475b53ab7e6608c4016cf8f0
SHA1

bee0ebbb3721fe5bcc792dd0b12f4b342b0c52b5
SHA256

c54901a3521a7f0590c848c71644cfbad1b1735206889d82706d0bf39973c184
SHA512

d76d40933a5fd06c636d853ddd115eed792ce8505cea1d36c68bcdce1857edd4f2a07b3df08ae8f009ee4944fc5fe14bb7fba8ad09f435dcc400c95577558c34
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUxB1H:T6a+rdOOtEvwDpjNtHPU

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	ce1733d0475b53ab7e6608c4016cf8f0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
624	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1020-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x00070000000232a4-13.dat	upx
behavioral2/memory/1020-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/624-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 624	1020	ce1733d0475b53ab7e6608c4016cf8f0_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 624	1020	ce1733d0475b53ab7e6608c4016cf8f0_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 624	1020	ce1733d0475b53ab7e6608c4016cf8f0_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\ce1733d0475b53ab7e6608c4016cf8f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ce1733d0475b53ab7e6608c4016cf8f0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
65be6adc9d7c556ac98cb6fa1c75b8c2

SHA1
02e54fac355639859f7f375ab78fa5e700ff1227

SHA256
4fc79f501cf0a66252990c76e67803cd8f9df270a4f4e72f54d6373cf0509ec1

SHA512
5d473efa4ee9b8e5b6625428f72b7fc1c884909004040582441f0b676c908bc7c68936e2f6a1b2fa047ceae62f36fa3ccea6fa16933c3dfdcfc332d32668bca8

Download Submit
memory/624-19-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/624-25-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/624-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1020-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1020-1-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/1020-2-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/1020-3-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1020-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download