Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 20:05
Behavioral task
behavioral1
Sample
2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe
-
Size
645KB
-
MD5
2c503f3afa7dc8b3ff80910eaee058b0
-
SHA1
67d1b22afc35b76b813a25f1a6d0beb5074bab68
-
SHA256
aa2228845b62429199c3bc15482fece687518c1b55e6d19a4816be2652159296
-
SHA512
9fda6580f08dcb171dc10da16d74cd7e5c3cfa138311d0bb680568d00d6c69cd6cf22c2b2e5359eeaf8dc01948eecbf9816275509faf0557c9015fdfcd8658d2
-
SSDEEP
12288:p700p8Erbi0OpL46A9jmP/uhu/yMS08CkntxYRgL:zp8Erb+GfmP/UDMS08Ckn37
Malware Config
Extracted
kutaki
http://newlinkwotolove.club/love/three.php
Signatures
-
Kutaki Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tonzanfk.exe family_kutaki -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops startup file 2 IoCs
Processes:
2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tonzanfk.exe 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tonzanfk.exe 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
tonzanfk.exepid process 3376 tonzanfk.exe -
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid process 528 mspaint.exe 528 mspaint.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exetonzanfk.exemspaint.exepid process 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe 3376 tonzanfk.exe 3376 tonzanfk.exe 3376 tonzanfk.exe 528 mspaint.exe 528 mspaint.exe 528 mspaint.exe 528 mspaint.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.execmd.exedescription pid process target process PID 3348 wrote to memory of 4192 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe cmd.exe PID 3348 wrote to memory of 4192 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe cmd.exe PID 3348 wrote to memory of 4192 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe cmd.exe PID 3348 wrote to memory of 3376 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe tonzanfk.exe PID 3348 wrote to memory of 3376 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe tonzanfk.exe PID 3348 wrote to memory of 3376 3348 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe tonzanfk.exe PID 4192 wrote to memory of 528 4192 cmd.exe mspaint.exe PID 4192 wrote to memory of 528 4192 cmd.exe mspaint.exe PID 4192 wrote to memory of 528 4192 cmd.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp"3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tonzanfk.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tonzanfk.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tonzanfk.exeFilesize
645KB
MD52c503f3afa7dc8b3ff80910eaee058b0
SHA167d1b22afc35b76b813a25f1a6d0beb5074bab68
SHA256aa2228845b62429199c3bc15482fece687518c1b55e6d19a4816be2652159296
SHA5129fda6580f08dcb171dc10da16d74cd7e5c3cfa138311d0bb680568d00d6c69cd6cf22c2b2e5359eeaf8dc01948eecbf9816275509faf0557c9015fdfcd8658d2