f8d51e735aaee7fcd41ed7d9e3392f6ecae936f306b534dccdb0550ad1314eb0

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe
Size

32KB
MD5

513c605fd68c0e684d3631d95645c410
SHA1

95d598d1ec88969e6bb9c6d2c5c344b67a94290c
SHA256

f8d51e735aaee7fcd41ed7d9e3392f6ecae936f306b534dccdb0550ad1314eb0
SHA512

799026b7aa71b52c8ae27c01a2aaf0c294b999f9fbae7031440acf1a59c7d31a127de9c7cebeb59fbef0ef485efe34b387e3b190c9928819d1742143b4257782
SSDEEP

768:uPHGuSrB0EakzhCG611DhEg4H1zpTyGWDk:smuSnLCPeHm/A

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

3016 budha.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3016	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe

description	pid	process	target process
PID 4268 wrote to memory of 3016	4268	513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe	budha.exe
PID 4268 wrote to memory of 3016	4268	513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe	budha.exe
PID 4268 wrote to memory of 3016	4268	513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\513c605fd68c0e684d3631d95645c410_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
33KB

MD5
b410076337bb4c42d94d8feb0a0a7b41

SHA1
f54a0f1d859de5feffc449375f91450cbb1239d4

SHA256
cb4f89d6e5e05d0ce051c699356ebdf83df18b9846221c8936ebc34c6fc21858

SHA512
5e22d218ba06beb64afa77f207a58cee3d1fbc4551561772d5a3f9769713c9c9030696ac5aa32a1cbc5ffd3b05bd6ddb532c9d706e42b81b6777564184a55990

Download Submit
memory/3016-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3016-14-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/3016-15-0x0000000002430000-0x0000000002830000-memory.dmp

Filesize
4.0MB

Download
memory/3016-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4268-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4268-2-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/4268-3-0x00000000023D0000-0x00000000027D0000-memory.dmp

Filesize
4.0MB

Download
memory/4268-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download