58e4fb9b92e5241e99f2f973837b2f19c64a79f3b81af0218c6b9daed2314345

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e5bc6e2783bccec52d1fdc07a4ad6330_NeikiAnalytics.exe
Size

35KB
MD5

e5bc6e2783bccec52d1fdc07a4ad6330
SHA1

e389a7acb0278eceb45d43f39aedbac849a22799
SHA256

58e4fb9b92e5241e99f2f973837b2f19c64a79f3b81af0218c6b9daed2314345
SHA512

80fbd2014ed7587faab3ed7b4ffa4fbed521014ed7c77be33c27fb0ea8b66843e5ee33430f2156fdfe3334027fb088a4e6e251fc5d85b5421c2371f107a2653d
SSDEEP

384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLyG+mHDiJWs3W97KDiiczq+fLoV90:d/3xd1HXzoy44hXPjiJ67tZqvk3jJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	e5bc6e2783bccec52d1fdc07a4ad6330_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1092	update_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1092	2984	e5bc6e2783bccec52d1fdc07a4ad6330_NeikiAnalytics.exe	82
PID 2984 wrote to memory of 1092	2984	e5bc6e2783bccec52d1fdc07a4ad6330_NeikiAnalytics.exe	82
PID 2984 wrote to memory of 1092	2984	e5bc6e2783bccec52d1fdc07a4ad6330_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\e5bc6e2783bccec52d1fdc07a4ad6330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e5bc6e2783bccec52d1fdc07a4ad6330_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\update_pdf.exe

Filesize
35KB

MD5
8e956f0f8c23b4af1b63a658c4480cdf

SHA1
08e83fd0f71765e21cb7f530275d0cc42e87bb98

SHA256
e01343b3c16aa5a4baf70735f25fffa87b4faac3c192fec07056db732ba59f99

SHA512
64ac12f30224b177fd220c51b28e6339b81abbdd935e197f1de94360551cabc5da13199599c8807127f57dc6b5d17b302698962eff068eab365c182c1e95d7c5

Download Submit
memory/1092-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2984-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download