f51ebda26763f3351f47718fcddf5882c5caedd4552101c4dbb67ddba388feef

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe
Size 78KB
Sample240519-2xnvqsff57
SHA256 f51ebda26763f3351f47718fcddf5882c5caedd4552101c4dbb67ddba388feef
MD5 53a4e983be098b00725acbace4d3cd30
SHA1 05f2effac16bb6975154b41a1712158d6c526b90
SHA512 be89071b72bc8db30d9dc7d8b6f92e71ab2d71d73bac9b1df24034cebd04c1e53cac4dd7d57e85202cfc0fe02c041a7a9fb7ef0afbe09ad6d81556c1c3a98fd6
SSDEEP 1536:lWV5jSBLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6A9/x1mv:lWV5jSZE2EwR4uY41HyvY/9/c
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2032	tmp2E05.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2032	tmp2E05.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp2E05.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe
Token: SeDebugPrivilege	2032	tmp2E05.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3272	4432	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe	83
PID 4432 wrote to memory of 3272	4432	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe	83
PID 4432 wrote to memory of 3272	4432	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe	83
PID 3272 wrote to memory of 3872	3272	vbc.exe	85
PID 3272 wrote to memory of 3872	3272	vbc.exe	85
PID 3272 wrote to memory of 3872	3272	vbc.exe	85
PID 4432 wrote to memory of 2032	4432	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe	88
PID 4432 wrote to memory of 2032	4432	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe	88
PID 4432 wrote to memory of 2032	4432	53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\17lxc-gj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EB1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEF3751F65CDE407D8F1431702E10DAA4.TMP"
    3⤵
    PID:3872
- C:\Users\Admin\AppData\Local\Temp\tmp2E05.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp2E05.tmp.exe" C:\Users\Admin\AppData\Local\Temp\53a4e983be098b00725acbace4d3cd30_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17lxc-gj.0.vb

Path C:\Users\Admin\AppData\Local\Temp\17lxc-gj.0.vb
Size 14KB
SHA256 0ea494671bd5f1baecca5fcb7891375301181936790c7ef71539b293db8e6543
MD5 dbb6926df1a073db05a91e1017d9da21
SHA1 2e67b2899a991cfe4ccde1c128828a80bbccd2e3
SHA512 d5dd5fa66671eec663c69328760bc220cf70d672a3c36865b0c0ebb3825349c061698b7aa1f6b8a2a8eb4a801e64dc5430ac95e31fe1cf8294a39d8d7a309473
SSDEEP 384:rVN+N8TNwtN5bdjjSN5NzcHbwE6NzMzN7QrSN7eP:zyUw/n+TzcHwzMhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

17lxc-gj.cmdline

Path C:\Users\Admin\AppData\Local\Temp\17lxc-gj.cmdline
Size 266B
SHA256 21e499348ddfd7d799c701166b79eaa0028e6171f8019eaa5b241892317342f1
MD5 c6db010b3ad31987223137ee526e91fb
SHA1 3324e2ead411afd9a9bb999c17d62c2b36206a5a
SHA512 dbedf30e1dca1773400e0245fac5b3bc2331d305cdc90cf849b1a7928492dbbe4bd9c69cfa93f0171f615b44d8e048db6879c7c00d3b7abb6966ac056206b319
MD5 SHA1 SHA512

Submit Download

RES2EB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2EB1.tmp
Size 1KB
SHA256 887672722e3e9c2fa104221bcc0f945e6538eeb14164b7e3ccb7265924d1d5ee
MD5 29090b84d47b05f9451c4520d12767b9
SHA1 78198209557187e7091e7a8af8c1efea86df5225
SHA512 eb1f68ee92f415f329f77dd77abfaada13a44990ed9a6683df2b629e05fed19794136afb77f88abf6c1ccb91a54a6946a184c6b1d00abca9b102c82537c533df
MD5 SHA1 SHA512

Submit Download

tmp2E05.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp2E05.tmp.exe
Size 78KB
SHA256 b8f0935a5e7e7188cc60c48197ab1810f9dcca90aa8361d36383419c75f28a04
MD5 8349d9f572b763126b0b2b730e6eb6ae
SHA1 926744ed03424c8ac5d53d55be79f5836ed4d9b3
SHA512 40d7b554a0473f04a2f10e64f2157172e573ebf2fe18ea034ce7f2a4dca95c3407070e47c94868d3ab59c77768b12be7547b3ec64c3380435f55527cd05dcf4a
SSDEEP 1536:VStHY6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLI9/G1p4:VStHY8dSE2EwR4uY41HyvYLI9/t
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcEF3751F65CDE407D8F1431702E10DAA4.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcEF3751F65CDE407D8F1431702E10DAA4.TMP
Size 660B
SHA256 d3459a4f3e0e56b3b555f3b19036927b38087a1905d075a00cdc92ee028fa31a
MD5 5abf66925f233ef37d634716685b8483
SHA1 d84ef513496534059facfe1a522a50fd107b266a
SHA512 9304db28cbfbe92c05cda3fa35f2bd603cad00a6f77d63d78f76dd74800d9cf2b8fd3961b8c8be53484da3f7839fd926968b496e250ecd4e957cd241bfaeec33
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2032-24-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/2032-23-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/2032-26-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/2032-27-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/2032-28-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/3272-9-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/3272-18-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/4432-2-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/4432-22-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/4432-0-0x00000000753A2000-0x00000000753A3000-memory.dmp

Download

memory/4432-1-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads