ff81dbc574888599b36250a530e17a708afba673e1cd19b6ddb5af24619b9325

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89934a0ae69a56767e5123c829a4fd90_NeikiAnalytics.exe
Size

84KB
MD5

89934a0ae69a56767e5123c829a4fd90
SHA1

2541f8271f69f5c6d67b0d17e5c7c97fb18efbf0
SHA256

ff81dbc574888599b36250a530e17a708afba673e1cd19b6ddb5af24619b9325
SHA512

54e16c953cf505929614038740f24663677b027b5874f31aca11a373976ae9176b9df76029fb58b46c776c8dd3fd0aef689602edce14ce6194ea97f37a821a66
SSDEEP

1536:HRfZ7DkJBxC1MqmRzB+0ihT5RJ2EzkjZ0vBJ52zq9aGgUjfSfp:HRfFDkJBAMvBrivRJ28CZEcGg8qx

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	89934a0ae69a56767e5123c829a4fd90_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	hhcbrnaff.exe

Executes dropped EXE 1 IoCs

pid	Process
1396	hhcbrnaff.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1020-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-7.dat	upx
behavioral2/memory/1020-12-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/1396-31-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1396	1020	89934a0ae69a56767e5123c829a4fd90_NeikiAnalytics.exe	83
PID 1020 wrote to memory of 1396	1020	89934a0ae69a56767e5123c829a4fd90_NeikiAnalytics.exe	83
PID 1020 wrote to memory of 1396	1020	89934a0ae69a56767e5123c829a4fd90_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\89934a0ae69a56767e5123c829a4fd90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89934a0ae69a56767e5123c829a4fd90_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
  "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

Filesize
84KB

MD5
a80a2cb4519729643a195aadee4fdc3b

SHA1
f75e77d26766979fb8d8ada55a559aa31824fb71

SHA256
507d9dcdd27d86b517cd1f17ed148d47d1b72e6bd33ee6fa0260727e93234d38

SHA512
c8b5c1fd40d0bd677d5be132ff98ca64c7fc124ada36df477cd556c4ae2d89bf029a1ba2b04edd387a62ec6f60bfcf5405652a78c380fa1d3d02281b4b9fd8ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\hhgnrddkjee.exe

Filesize
1KB

MD5
30b8a784f9ce428c09ed2a31d6f6b064

SHA1
d01fc11da9e0616597bda1e7de336b24033476fb

SHA256
9960a4a38e316063171768bde57fb77d2dfc50ae8cf72908ae338d61faa08148

SHA512
2b578b3f68ce6769b64380d9caee65ad74839664b8a13d6c29df91ef74ffbf2e6c339737d10963ca4d6ae2cb6fa9031a5bb4b6022ba109fd11e74cff43fbff93

Download Submit
memory/1020-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1020-2-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/1020-3-0x0000000002670000-0x0000000002A70000-memory.dmp

Filesize
4.0MB

Download
memory/1020-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1396-14-0x0000000002560000-0x0000000002960000-memory.dmp

Filesize
4.0MB

Download
memory/1396-13-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/1396-31-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download