8ddd72fbe374ecd33dfb6b70bbcb0e1c1ef6c556c25f554d607ea7a20257eeb2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe
Size

38KB
MD5

69af338a8e89bef5282d5dab1006e040
SHA1

c97a887aa39129db21bc94784a0507e5c4e6f7fb
SHA256

8ddd72fbe374ecd33dfb6b70bbcb0e1c1ef6c556c25f554d607ea7a20257eeb2
SHA512

d675d0a6419f59a77ff224eecae136efafb4ca768642acc133fea5aaed7b6ade31cf86e265d9dc59671420cf3e1b531572dc37aa6b3c6fa1cbaba3dfac938897
SSDEEP

768:jf/hLlNgcDZVPaM7QvmadHZyzY/y76WxQWngi++yilF2jmE:jxLIc3PR7RazyzGyGIqvaF2Z

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

WgaDisp.exe

pid process

4192 WgaDisp.exe

pid	process
4192	WgaDisp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\_WGA = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WgaDisp.exe"	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: LoadsDriver 10 IoCs

Processes:

pid

4
4
4
4
4
660
4
4
4
4

pid
4
4
4
4
4
660
4
4
4
4

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe

description	pid	process	target process
PID 1508 wrote to memory of 4192	1508	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe	WgaDisp.exe
PID 1508 wrote to memory of 4192	1508	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe	WgaDisp.exe
PID 1508 wrote to memory of 4192	1508	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe	WgaDisp.exe
PID 1508 wrote to memory of 4572	1508	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe	cmd.exe
PID 1508 wrote to memory of 4572	1508	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe	cmd.exe
PID 1508 wrote to memory of 4572	1508	69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\69af338a8e89bef5282d5dab1006e040_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1508

C:\Users\Admin\AppData\Local\Temp\WgaDisp.exe
"C:\Users\Admin\AppData\Local\Temp\WgaDisp.exe"
2⤵
- Executes dropped EXE
PID:4192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_DelItK.bat" "
2⤵
PID:4572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WgaDisp.exe
Filesize
38KB

MD5
81533fc957da652180a25842fe88db83

SHA1
3c1d0c417c26dee1b986d9abf648ef4f0f8778b1

SHA256
f362be63473b621e4ca7a7fcfc22df5dacb52ba4fbca98929649778dff580bbf

SHA512
1ae10aa0bf68242f0871a3e8a205e3bf02dbdbb17ce5687db1fd4ec39d050a77257bd326d84e48d37949493215c117ffecaebdf029f07fab792c651b4df9151d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_DelItK.bat
Filesize
261B

MD5
db2257faa01f4ffbfdf2501183151ecc

SHA1
ddb7c8ff9f88cdc40aef6fb0f008346f91f22365

SHA256
4f0e3c778e0524d1421cfa876f621b0c80ea43d36bdf19192636d4d4740e9a49

SHA512
628286359d963b4d91bbbd0f276be2e79f1464acc783fbf347700584e43682a9893451f7069394685abf9e8905ead4bf13726854396a8de604375f17db875845

Download Submit
memory/1508-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1508-13-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4192-9-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4192-15-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4192-24-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download