bf6b465987601387f0988dc1f937ab5714b04c7f4a757e2b1cc11ce1d2a9f763

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe
Size

34KB
MD5

0a1c0d44f78058e9b295aa9089302b20
SHA1

ef47d13dc3e23c1b3b408f45ef9e175c8799fd9a
SHA256

bf6b465987601387f0988dc1f937ab5714b04c7f4a757e2b1cc11ce1d2a9f763
SHA512

67d6a1f6fad6c52831fc742cbfacca597a58df6494c5a3d4fe02c4ee0ef2b8ba379746470bd0799d58357c04ff42d109d9d8883077ae255b6ea424fe784efb0f
SSDEEP

384:MApc8m4e0LvQak4JI341CNabnkIU0SqwunabV/6II:MApQr0LvdFJI34nTkIU0ZnwI

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

sal.exe

pid process

2580 sal.exe
Drops file in System32 directory 1 IoCs

Processes:

0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe

description ioc process

File created \??\c:\windows\SysWOW64\sal.exe 0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2580	sal.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\sal.exe	0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe

description	pid	process	target process
PID 2812 wrote to memory of 2580	2812	0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe	sal.exe
PID 2812 wrote to memory of 2580	2812	0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe	sal.exe
PID 2812 wrote to memory of 2580	2812	0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe	sal.exe

C:\Users\Admin\AppData\Local\Temp\0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0a1c0d44f78058e9b295aa9089302b20_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2812
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sal.exe

Filesize
34KB

MD5
3b0ceaac2895807c331cff0ad497717e

SHA1
bb073387ada4f2019eb636ea4690ad43c99c6dcd

SHA256
256aee8045abeab657eec587641bef1da7e70a804167f51725e06d685c5113b4

SHA512
9d39307e4eb2ff718b29c26f2246052b72f332ffdd578df05c6a983fe8519981ea0b23074f74a20ea9bef13474bf56c5bb4348d8651da12e53e7eadc1d63363c

Download Submit
memory/2580-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2812-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2812-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download