06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006_NeikiAnalytics.exe
Size

1.9MB
MD5

20474fd7892f1e8a8fb13ea140dab980
SHA1

850758f9a33b006071102e61220533c52c695373
SHA256

06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006
SHA512

f80cc113191acc951e23cde44a64479893af68c5b853f678ac746c117e266f154d2cfa4d0178c75790c41596d37eec46937739ffb0758bf9eb5cd0bf2e154a45
SSDEEP

49152:xx5vh5uEIAdRx4D6F49fBXImVQnalotoN33mtREbMKi:xx5vhtIAdRxi6G9ftImVQnqoCN33/oKi

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
1596	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 1596	3684	06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006_NeikiAnalytics.exe	83
PID 3684 wrote to memory of 1596	3684	06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006_NeikiAnalytics.exe	83
PID 3684 wrote to memory of 1596	3684	06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06aeb5cc58ecdce908be32bf74ddb362002909d934dbd972f57839428bd45006_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" .\9nan.F4g /s
  2⤵
  - Loads dropped DLL
  PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9nan.F4g

Filesize
1.9MB

MD5
bc224ddbac355d1581bc20ee9d7a3b2c

SHA1
8307930227c8267ce19640f5ec786a3954ef851d

SHA256
c87a92fba111f8a7829b8710d8a40ec479c355c09a5431a93d30bbf88fd35ae3

SHA512
68cd838a6a41a32431a53af0cd5a35986962a1d55bc10a08589a8a04ed6ebf7012d72d69a42ed460e5132a3e58214365fd691c697104c684b345c1aa2a0b402e

Download Submit
memory/1596-4-0x0000000000B90000-0x0000000000B96000-memory.dmp

Filesize
24KB

Download
memory/1596-5-0x0000000010000000-0x00000000101E9000-memory.dmp

Filesize
1.9MB

Download
memory/1596-7-0x0000000000CF0000-0x0000000000E07000-memory.dmp

Filesize
1.1MB

Download
memory/1596-8-0x00000000025C0000-0x00000000026BE000-memory.dmp

Filesize
1016KB

Download
memory/1596-11-0x00000000025C0000-0x00000000026BE000-memory.dmp

Filesize
1016KB

Download
memory/1596-12-0x0000000010000000-0x00000000101E9000-memory.dmp

Filesize
1.9MB

Download
memory/1596-15-0x00000000025C0000-0x00000000026BE000-memory.dmp

Filesize
1016KB

Download
memory/1596-16-0x00000000029D0000-0x00000000030D8000-memory.dmp

Filesize
7.0MB

Download
memory/1596-17-0x00000000030E0000-0x00000000031CB000-memory.dmp

Filesize
940KB

Download
memory/1596-18-0x00000000031D0000-0x00000000032BD000-memory.dmp

Filesize
948KB

Download
memory/1596-19-0x00000000031D0000-0x00000000032BD000-memory.dmp

Filesize
948KB

Download
memory/1596-21-0x00000000031D0000-0x00000000032BD000-memory.dmp

Filesize
948KB

Download
memory/1596-22-0x0000000000690000-0x0000000000692000-memory.dmp

Filesize
8KB

Download
memory/1596-23-0x000000004E220000-0x000000004E224000-memory.dmp

Filesize
16KB

Download