abbcfe9efedb55e5ebabd658ed2cf4e1c7e48d0d4b4a06ebef7d36a9a15b9a29

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe
Size

39KB
MD5

778d5770f46d048ea92e00ca4318fe00
SHA1

76d95a029fa72156e123cc37dfe03b2759729de9
SHA256

abbcfe9efedb55e5ebabd658ed2cf4e1c7e48d0d4b4a06ebef7d36a9a15b9a29
SHA512

3a1582244bd9504431ec480f479094fff7a1328ee87a25ae333a2f0226cb5982f59163c21240b8250df5bca57b84ec4b51c58dddc87f1c6ff5553955ef02491c
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaB8:qDdFJy3QMOtEvwDpjjWMl7TdG

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

4452 asih.exe

pid	process
4452	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4292-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4292-10-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/4452-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe

description	pid	process	target process
PID 4292 wrote to memory of 4452	4292	778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe	asih.exe
PID 4292 wrote to memory of 4452	4292	778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe	asih.exe
PID 4292 wrote to memory of 4452	4292	778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\778d5770f46d048ea92e00ca4318fe00_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4292

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4028

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
39KB

MD5
a93eb08590f630bcb4593c32a99f4582

SHA1
75ca7f0047ca1d8ba941e1e0636ad34b4d297807

SHA256
fb1791f5f8f6e4b5a0508388bd6cd3874ac539152a4a6efe7a79f7a26180b913

SHA512
43ff8579467c28feaa73e857e8d46ff39c4c3e802332859638af7dfa2e60795aa43e8bca6475b0653acf8de04079392b90a7f5a497371d0f26534caa617e1c00

Download Submit
memory/4292-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4292-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4292-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4292-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4292-10-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4452-20-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/4452-27-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/4452-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download