80b226f3c2a5571daf8301661277a25899fc6622b8ff4e0b1ddea99821ae6907

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
Size

45KB
MD5

bebd7c90d3c6e7441357fa81d19bae90
SHA1

99d01f9f085610f3b7e964d679a61379e28d7367
SHA256

80b226f3c2a5571daf8301661277a25899fc6622b8ff4e0b1ddea99821ae6907
SHA512

f545b5d8e4181891647dd9a44a207632e1369772ea24786d9360c4b744475387b79805b59fd166a7be13db453837401e18b7bb7306dbadf08749864570e1d112
SSDEEP

768:zIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77NPQ1TTGfGYy6KL:zI0OGrOy6NvSpMZVQ1JQKL

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
griptoloji
Password:
741852

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1300	jusched.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre-09\bin\UF	bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Java\jre-09\bin\jusched.exe	bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Java\jre-09\bin\jusched.exe	bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe
1300	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1300	3316	bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe	83
PID 3316 wrote to memory of 1300	3316	bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe	83
PID 3316 wrote to memory of 1300	3316	bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files (x86)\Java\jre-09\bin\jusched.exe
  "C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Java\jre-09\bin\jusched.exe

Filesize
45KB

MD5
8f4c95935518f5112bbf45325fc05787

SHA1
2bae4e014c3788f70032f473e3635ef8fd1982a3

SHA256
cec7438e4dd51cfab70754717623fd1a0fb453f951a8582b7fe1c725ec13aefc

SHA512
12564927e705263ae6c2940d345739a3f37ed29c2c5e24dfd854539909378980b43d30f25497ce61a51b6a962bdb12695e6d9bac323700d0c2c8964ea7412299

Download Submit
memory/1300-13-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1300-19-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1300-20-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3316-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3316-12-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download