9e2295822db730a8d30b27ee495010d0bf766e46603fe38a16a6cc679cc6458d

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c449c4290427fcf94b3ebea6b43f130_NeikiAnalytics.exe
Size

2.2MB
MD5

7c449c4290427fcf94b3ebea6b43f130
SHA1

f6b00f8e4ba274f18a1cbc34a36732ba9ccd51e2
SHA256

9e2295822db730a8d30b27ee495010d0bf766e46603fe38a16a6cc679cc6458d
SHA512

5894cbcd2f92e41a28962053596dbe6cb0e9e4510803ee9c50a0e55a0ebb77c2e38041f1ab4c6fe97366a659bb63bfedc46d575c9374636dd811bf4dc51b0ad2
SSDEEP

49152:1monDCpDHLQqtdzjzKvR5tdjmujf2QhS3XfAy0SZkO+e7ogSZG97Pi4Snw:1mouDHBzjzmvj9fW/TVNx97K44w

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7c449c4290427fcf94b3ebea6b43f130_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
724	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 724	2388	7c449c4290427fcf94b3ebea6b43f130_NeikiAnalytics.exe	89
PID 2388 wrote to memory of 724	2388	7c449c4290427fcf94b3ebea6b43f130_NeikiAnalytics.exe	89
PID 2388 wrote to memory of 724	2388	7c449c4290427fcf94b3ebea6b43f130_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\7c449c4290427fcf94b3ebea6b43f130_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7c449c4290427fcf94b3ebea6b43f130_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s .\AYJRx_.XKY /U
  2⤵
  - Loads dropped DLL
  PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AYJRx_.XKY

Filesize
2.0MB

MD5
31e0e3f24190ff09e2a0db32af026385

SHA1
c47ef3c383b6f85621e2e7160c6d0931d7d97eda

SHA256
98819908f1da729245826bc0f5bacf36cded7af8229345ed48b3e280b895cebc

SHA512
a9afc9318e366160bd3cc818332585fd85c33001c3f44864920c3a8c2cf4fbf89fdfcdfa689ed9e44de6800b6622cef5b2ea461b3ac5f3b8a3b08a381e192e5e

Download Submit
memory/724-4-0x00000000008B0000-0x00000000008B6000-memory.dmp

Filesize
24KB

Download
memory/724-5-0x0000000010000000-0x0000000010203000-memory.dmp

Filesize
2.0MB

Download
memory/724-7-0x0000000002650000-0x0000000002773000-memory.dmp

Filesize
1.1MB

Download
memory/724-9-0x0000000002780000-0x0000000002888000-memory.dmp

Filesize
1.0MB

Download
memory/724-8-0x0000000002780000-0x0000000002888000-memory.dmp

Filesize
1.0MB

Download
memory/724-11-0x0000000002780000-0x0000000002888000-memory.dmp

Filesize
1.0MB

Download
memory/724-12-0x0000000002780000-0x0000000002888000-memory.dmp

Filesize
1.0MB

Download