Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
756d0566a907d1a6bbbc0598147137e0
-
SHA1
216e975ca96dac997b13e66a2781161177920ea0
-
SHA256
88f068f27f9a49cc62485d232b0d24ea46b0b363a9645f15c98b2d12a251cc1e
-
SHA512
450179140aaa14d82d46c977f6186e7a21a040a7f13e80f732006de556a4f071577c0d1cfe3fdf016dbd4bcfaa619ec5c2dd51484d0942a3bc527d7816d10f80
-
SSDEEP
1536:vNkg8r8Q7PkT+7Kp3StjEMjmLM3ztDJWZsXy4JzxPMk:YPkCJJjmLM3zRJWZsXy4JN
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
gbjif.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gbjif.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
gbjif.exepid process 2800 gbjif.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
gbjif.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gbjif = "C:\\Users\\Admin\\gbjif.exe" gbjif.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
gbjif.exepid process 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe 2800 gbjif.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exegbjif.exepid process 3724 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe 2800 gbjif.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exegbjif.exedescription pid process target process PID 3724 wrote to memory of 2800 3724 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe gbjif.exe PID 3724 wrote to memory of 2800 3724 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe gbjif.exe PID 3724 wrote to memory of 2800 3724 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe gbjif.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2800 wrote to memory of 3724 2800 gbjif.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\gbjif.exe"C:\Users\Admin\gbjif.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\gbjif.exeFilesize
53KB
MD5c600990160ab43a8ded89c46988bb2ca
SHA131d1a309d1c0e38dccc3ddbb585d13059aef3a41
SHA256a9a721fbbcc3944ec52019106fe5d8d36e40389dd3c053d14f8976472fa852e4
SHA512dfb3d540b42af2dc56c5ebe56b55b9a880d3155b3b4bce9d98e6167cc6386c00d25e566db025c3c09f6d6379eaee493bef3c49bd54aff24df5072bf057945b44
-
memory/2800-34-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3724-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB