f8539d67cf78ffe23014069dd8730e03ceeeca645f9cf818e5f9d989844d9ad9

Analysis

max time kernel
132s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aa7c06d9ee52c8b5e055b15f179d630_NeikiAnalytics.exe
Size

47KB
MD5

9aa7c06d9ee52c8b5e055b15f179d630
SHA1

459e71441360d9713f856f4e6fab0c7201ebf0b7
SHA256

f8539d67cf78ffe23014069dd8730e03ceeeca645f9cf818e5f9d989844d9ad9
SHA512

f6d3d601d512e680f68e4bb6348747ca01f2f5579cfb1a442293eb512553694c550f832a6afc0e1cad29aec4b1c795097b3e06436e3805e576d3a399cccdfd02
SSDEEP

768:n8eRH+MlFh0pXrL4i6sh7iQroCHmmbk2N4:n9l+Gi6sh7iQroCLG

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	9aa7c06d9ee52c8b5e055b15f179d630_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4516	bkgrnd.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/840-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x0008000000023306-7.dat	upx
behavioral2/memory/4516-11-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/840-12-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4516-21-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 4516	840	9aa7c06d9ee52c8b5e055b15f179d630_NeikiAnalytics.exe	83
PID 840 wrote to memory of 4516	840	9aa7c06d9ee52c8b5e055b15f179d630_NeikiAnalytics.exe	83
PID 840 wrote to memory of 4516	840	9aa7c06d9ee52c8b5e055b15f179d630_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\9aa7c06d9ee52c8b5e055b15f179d630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9aa7c06d9ee52c8b5e055b15f179d630_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
  "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
  2⤵
  - Executes dropped EXE
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe

Filesize
47KB

MD5
5b2f086f76fbd8952155861a5d1315f5

SHA1
948af218a04d8eeecbfccd3516ec3c2c90ce9846

SHA256
52d68cef9803fb43c08bbfd9cc643f9232fb6924f06ab16e26a0f147cd714490

SHA512
1df48782e2374db36a63983941862b4b484f06b631d33a8300d6b3ab21b76cbedac184ab67d0a202aedf632b4f2c8f1857476156783aab8fa44d5e931d86f6ea

Download Submit
memory/840-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/840-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/840-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/840-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4516-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4516-21-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download