Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
27f7cacd5988bfbc08cfdf11f9a30cd0
-
SHA1
bb50d8f49e88eeaf34db2aa15fcaa5e08866be6f
-
SHA256
5664067697ffb038fb997f5dc88a4378eb1f5c7ec2c9329657529c0ed9801fb3
-
SHA512
c35c126c451af47404f9bf28426e7e29ec74ab4345976f2397f268ce2455a8461d044d3fc478e26137bd6f4d8c3d97dd22cd76706cfb33846d2d2e36a5634445
-
SSDEEP
1536:vN+g8r8Q6VcLX17Kp3StjEMjmLM3ztDJWZsXy4JzxPME:TVcZJJjmLM3zRJWZsXy4Jt
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nsmiag.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 952 nsmiag.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsmiag = "C:\\Users\\Admin\\nsmiag.exe" nsmiag.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe 952 nsmiag.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 8 27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe 952 nsmiag.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 8 wrote to memory of 952 8 27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe 91 PID 8 wrote to memory of 952 8 27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe 91 PID 8 wrote to memory of 952 8 27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe 91 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82 PID 952 wrote to memory of 8 952 nsmiag.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\27f7cacd5988bfbc08cfdf11f9a30cd0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\nsmiag.exe"C:\Users\Admin\nsmiag.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD50657886ed27879c43d2942dda2eed623
SHA1952ba7378b50bb233f7344e8333c25913aafe3f3
SHA2565a84dd3b328c40a10d63d8383df6f9c74f1f020515fcc1872d72efaf558df2fc
SHA5122350a1f523c592dff001b8dd1feae74267e35df704dff25cf81ca1a928a4b5c4ec22d2dbcffe622a0fdb140a68aa883cab0e4601d943d9afc7965abad5de6b7b