Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe
-
Size
53KB
-
MD5
ca6e27be699aba9bde4b675c410e6930
-
SHA1
c170db8faed111ae71093334d32578d6d81cb163
-
SHA256
8b8ba42a0aee735f3d95af34996488349ff0703dd37822671cd6b3bb1f1411ca
-
SHA512
ff9d706937d7c84f622edf578ff1aa96b2561b93991cfe8169ad4ae830d55f4b67d4cd7538c30257bd67eda5d27cb13dbab4e27ebed028b47172c9a80216a597
-
SSDEEP
1536:vNKg8r8Q8Jm67Kp3StjEMjmLM3ztDJWZsXy4JzxPM0:FJm6JJjmLM3zRJWZsXy4Jd
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" voaxug.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 3612 voaxug.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voaxug = "C:\\Users\\Admin\\voaxug.exe" voaxug.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe 3612 voaxug.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 696 ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe 3612 voaxug.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 696 wrote to memory of 3612 696 ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe 87 PID 696 wrote to memory of 3612 696 ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe 87 PID 696 wrote to memory of 3612 696 ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe 87 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81 PID 3612 wrote to memory of 696 3612 voaxug.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ca6e27be699aba9bde4b675c410e6930_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\voaxug.exe"C:\Users\Admin\voaxug.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD568b98dc278b9fc647ebb1f5d5be046d2
SHA128def8ca82c3223a66989abb486fb7990a22c9a0
SHA256f6a41f19f18e36f7c837411903fbe02621778336c1be794a0054792e6c9cdd0c
SHA5123a5a6473df293f1f221005380f5b2d49f96ce9281a9725e882aecbd708d99c7d39b167327f393a0be6939e1a1ac8b264ffbf74d5288067c631bcdda5907fd54e