Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 13:21

General

  • Target

    e070a1d6a67dd4c45b7ba096e3514e00_NeikiAnalytics.exe

  • Size

    74KB

  • MD5

    e070a1d6a67dd4c45b7ba096e3514e00

  • SHA1

    c72028fbbb9c7b271773b503ddd5d7780226fe41

  • SHA256

    7074b85c9fc95e4ec2b043127e8611966d31b819a83d53599632be30fad778af

  • SHA512

    b4f803ea57c47aed90d2456f25b6ebd59b184357d86381a6f26b272f75a86243214e3723a364d8c836213e7f70130e640d176cd136f0c18fe2cad45be0377785

  • SSDEEP

    1536:53Bi77wAlPQzRssMm0wlm0yQzRssI1bOJPqnwHzc3VGu53VUYxC7Cvn39IYMRNbT:53Bg1lQzRssiCyQzRssywHzc3VGu53Vc

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e070a1d6a67dd4c45b7ba096e3514e00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e070a1d6a67dd4c45b7ba096e3514e00_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Users\Admin\AppData\Local\Temp\kdwco.exe
      "C:\Users\Admin\AppData\Local\Temp\kdwco.exe"
      2⤵
      • Executes dropped EXE
      PID:3576
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2852

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\kdwco.exe

      Filesize

      74KB

      MD5

      c2d555c8fc3e3a342590c5c4987f8dc6

      SHA1

      946fbfe97c82777cdecfcfec74ebbec77ce331cf

      SHA256

      b426e9605358cbb6d9765e8de10648ab10abcebf2c61a74713cce723887deecc

      SHA512

      5f09849e6ccd61e74952bb870f9f816f41d4dd9c88096bb2db12bd7c8c0dbfc2ffd3e4dcf9b108d83259427bb15cb1cdd906ed0fcd840bc52980ab5c3591f441

    • memory/3152-0-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3152-1-0x0000000000401000-0x0000000000403000-memory.dmp

      Filesize

      8KB

    • memory/3152-16-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3576-12-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3576-15-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3576-19-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB