b5b0831e3bf1834073c649b2361b3d2041fce70cbe8ab761bbe6e3a00bf07fdc

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe
Size

45KB
MD5

5b23e1994b4b2d4f2026669562d0e220
SHA1

0dcd73aa83f8de17cc3462e74c7d8d1ffaaed163
SHA256

b5b0831e3bf1834073c649b2361b3d2041fce70cbe8ab761bbe6e3a00bf07fdc
SHA512

bfca1ba4b141b4a5a14c8e747b51d23e7f125c6d4971a619e60d2dda9f10a4fd40d312603a867c11690c0953a9eefc444957411482bdad726feab851acd84366
SSDEEP

768:fhjrhoahHKVxemgFxzpOd/22fZ3SNwqrj5rShj711OiL:ftrhXFwSzpOd/22fZ3HqVqjrTL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

newsupd.exe

pid process

3288 newsupd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3288	newsupd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe

description	pid	process	target process
PID 1320 wrote to memory of 3288	1320	5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe	newsupd.exe
PID 1320 wrote to memory of 3288	1320	5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe	newsupd.exe
PID 1320 wrote to memory of 3288	1320	5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe	newsupd.exe

C:\Users\Admin\AppData\Local\Temp\5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5b23e1994b4b2d4f2026669562d0e220_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Local\Temp\newsupd.exe
"C:\Users\Admin\AppData\Local\Temp\newsupd.exe"
2⤵
- Executes dropped EXE
PID:3288

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\newsupd.exe
Filesize
45KB

MD5
555c34eff82f2df47ea81545ea187cbe

SHA1
ba0d50228db12ffa7d1e8f1d389d0b1fea8f314e

SHA256
f6671dda98a9c82efdb319144cd7d8850fcee90cef586a35e2299cf75f1bbb82

SHA512
01e1e578189c9e85f1cbaf81d7a1898e6bc68c6edb72965807885d22124c73dae43f35b2dc6b153f06df137c6cac1a0db2704a9b6f505611628e2c4024f5fb8f

Download Submit
memory/1320-0-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/1320-1-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/3288-12-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download