2b2b456da3a812fa205f787262f07d715ea0fb9de36892a51c896973fe001d42

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe
Size

53KB
MD5

20099f19192b4c1f23787b4ed1e85d90
SHA1

4645a9a88d58e099a489b60e793155e2d97414f4
SHA256

2b2b456da3a812fa205f787262f07d715ea0fb9de36892a51c896973fe001d42
SHA512

0f76fa90b770e8ee3af638eba81c1281bac88a1aeeb405f51686c40a3a99278c487fd2662b72a5da9130c9803a158450c6c2c1f35a86ec0b3648cd090a34970f
SSDEEP

1536:vNyg8r8QN6mWrB5CmT7Kp3StjEMjmLM3ztDJWZsXy4JzxPME:9B5CaJJjmLM3zRJWZsXy4Jt

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zoudu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4500	zoudu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zoudu = "C:\\Users\\Admin\\zoudu.exe"	zoudu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe
4500	zoudu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1712	20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe
4500	zoudu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4500	1712	20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe	89
PID 1712 wrote to memory of 4500	1712	20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe	89
PID 1712 wrote to memory of 4500	1712	20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe	89
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82
PID 4500 wrote to memory of 1712	4500	zoudu.exe	82

C:\Users\Admin\AppData\Local\Temp\20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\20099f19192b4c1f23787b4ed1e85d90_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\zoudu.exe
  "C:\Users\Admin\zoudu.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zoudu.exe

Filesize
53KB

MD5
c16889b404f6abb0f220a7621a2f2705

SHA1
880717732da448d8c5dbb603cec1d7dd322fcd2f

SHA256
27dfaefdf32899722d45645f83ec52c423d6589d144130d31c1c0a9ce782f982

SHA512
a138f862e379af733f543cd2b3fcffa40c8495cf147eea7994da58d08264ef7efb855887eb4c0ea8d6a8662ab005eaf8830b3c657a5866f22cb521e85d762a4b

Download Submit
memory/1712-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4500-33-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download