32e6e2d0aa8c3436503252682096aaa872655407d6f6ea68b6ad23435ae7aae5

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

db53a567c6b49d3d5669e770105a4770_NeikiAnalytics.exe
Size

90KB
MD5

db53a567c6b49d3d5669e770105a4770
SHA1

a0afcd675430c859e0356e01321d1237dfa17c52
SHA256

32e6e2d0aa8c3436503252682096aaa872655407d6f6ea68b6ad23435ae7aae5
SHA512

be606560a184dbeb50c459f3dd0ac2a2797404fc4e14e6562a15b9c5a31a24a0f52aab0ae0d2b58f2bc14ba6163db173b514ecc436709fd29af1863f68232fbf
SSDEEP

768:EsJhM/47dTkc8jmiG/7H1SE3KGdA6jVS2bnKHtIGA8/nVNEcoX7zPjqEifbGLPgp:EAA4R43e/7VOEjs2FRP2E6bqgJ6JZT0

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	db53a567c6b49d3d5669e770105a4770_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1444	wujek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1444	4188	db53a567c6b49d3d5669e770105a4770_NeikiAnalytics.exe	91
PID 4188 wrote to memory of 1444	4188	db53a567c6b49d3d5669e770105a4770_NeikiAnalytics.exe	91
PID 4188 wrote to memory of 1444	4188	db53a567c6b49d3d5669e770105a4770_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\db53a567c6b49d3d5669e770105a4770_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\db53a567c6b49d3d5669e770105a4770_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\wujek.exe
  "C:\Users\Admin\AppData\Local\Temp\wujek.exe"
  2⤵
  - Executes dropped EXE
  PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wujek.exe

Filesize
90KB

MD5
f6b997b9783a5cf6891b6cf09a2534ca

SHA1
7b3b68772137674ac4a784033a92d6713637a7aa

SHA256
92cd8adf15ec9fb2c42ffadcb3febc54396d5891e02e806cc668e4ab14c5f885

SHA512
740d4692ca561746c2b2e4c3ea2884812c68b79347852ce6aadb5dce262990fd9f3d4ecd84cad1f527a8a205bed13e10e089d191ea69db0f4b1e4d91c6defba7

Download Submit
memory/1444-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4188-0-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download