b4146072c2020779359d92dc0e56c984f1c6b3e6af56ca06d14190b7174c1f3d

Analysis

max time kernel
130s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

62bb2566d7708521a65988309e37d510_NeikiAnalytics.exe
Size

39KB
MD5

62bb2566d7708521a65988309e37d510
SHA1

53ffd2dc5a7dc75d0ccbbe551151dbd98bdc4a07
SHA256

b4146072c2020779359d92dc0e56c984f1c6b3e6af56ca06d14190b7174c1f3d
SHA512

f9e8b2cd6c3ab84ba89cc957e2e602d140dc13836dad9f6ec5c6a68b3e3a6fd5cb0fa4be2ba72acba11ec041507cd5f2c7e668f0495b2cd669584600f1acf580
SSDEEP

768:+veRH+9lFh0ul16sh7iQroCHxf+RjFBSuB2XGo/+1Q:+Gl+Z16sh7iQroCMRB0uA5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	62bb2566d7708521a65988309e37d510_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4876	bkgrnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4876	3108	62bb2566d7708521a65988309e37d510_NeikiAnalytics.exe	83
PID 3108 wrote to memory of 4876	3108	62bb2566d7708521a65988309e37d510_NeikiAnalytics.exe	83
PID 3108 wrote to memory of 4876	3108	62bb2566d7708521a65988309e37d510_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\62bb2566d7708521a65988309e37d510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\62bb2566d7708521a65988309e37d510_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
  "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
  2⤵
  - Executes dropped EXE
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe

Filesize
40KB

MD5
693dcf126f749f7ef23bc9f2cad309f1

SHA1
2386de740d3a610024ea3f0d05808cf2be9188a7

SHA256
d2108f426e475d7f4072579f3813310cb1062caf54d9fe3d84b811d4877419f8

SHA512
578f8eb025c5a68050fd402153272d238d5fd82e3219c00f38d16a03fafef6376b336810312545c738370e80b93a72954e62170153d6a4d5ba8216214541686f

Download Submit
memory/3108-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3108-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/3108-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/4876-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4876-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download