7a516194bdbb7e91f1216a930b34a0de9dcd366044fc3f6ae8ac92b04099ce21

Analysis

max time kernel
135s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5da293fc2452473288ca3956ca0e4540_NeikiAnalytics.exe
Size 1.3MB
Sample240526-d82c7sec95
SHA256 7a516194bdbb7e91f1216a930b34a0de9dcd366044fc3f6ae8ac92b04099ce21
MD5 5da293fc2452473288ca3956ca0e4540
SHA1 e613254422fb0f89a6d7e50315dc7702614c6721
SHA512 fc1fc4991019ae3994afb00afbaee5148f8319958732315e2a14a910254a317059b928a08c19484cd2f0dde7988bd583619ccf1ec52dbaf866cbfc85ccb3257e
SSDEEP 24576:DtPmwTSLEoWjLVcCaMngXllMWV4lid/T5nrl8j3zN1cZadLlvt944/Us02OK5WZa:DtewTSLEoWjpc/W+oUt+j35K4l9X/UZk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	5da293fc2452473288ca3956ca0e4540_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1196	Install LaunchManager.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1196	4952	5da293fc2452473288ca3956ca0e4540_NeikiAnalytics.exe	84
PID 4952 wrote to memory of 1196	4952	5da293fc2452473288ca3956ca0e4540_NeikiAnalytics.exe	84
PID 4952 wrote to memory of 1196	4952	5da293fc2452473288ca3956ca0e4540_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\5da293fc2452473288ca3956ca0e4540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5da293fc2452473288ca3956ca0e4540_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\AIR4DB2.tmp\Install LaunchManager.exe
  "C:\Users\Admin\AppData\Local\Temp\AIR4DB2.tmp\Install LaunchManager.exe"
  2⤵
  - Executes dropped EXE
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.launch

Path C:\Users\Admin\AppData\Local\Temp\AIR4DB2.tmp\.launch
Size 25B
SHA256 94d4d01019142c39bde132e03e5deb29e75d6552fc11518eb407cda7fb292b62
MD5 f5bddfcd3eb60bd97c1c2d458e754336
SHA1 fb2f0d565306a202ada183692dca78d91ff055bc
SHA512 ce93e1196f5f2656a42fd361ac01171a8b1629afda78d15c0084af874dc837e3a11e42d6dddea236af79095658d92fe311d911357611ece11f70fc7807b90641
MD5 SHA1 SHA512

Submit Download

Install LaunchManager.exe

Path C:\Users\Admin\AppData\Local\Temp\AIR4DB2.tmp\Install LaunchManager.exe
Size 128KB
SHA256 08cf1c7de4e8409b6f918685402baa48b164ab8d94815a55b8e7eacc53a3fa05
MD5 71eb9ef5a9a7e26be092d15c8b88abe1
SHA1 a6e55cf0179436933182fefe0985b19124143da0
SHA512 598f74d60b34edafa8e7aac5d14ab006daaba0c6a88eec0f81b120cdf634d5da3e9e31cbf73b1ec709f91907ee404a5e0f55e50a8a103c9b9bd994df1d399769
SSDEEP 1536:ALz+WD/ByzYxpCYL6bsUfPXZkubuxVQEw9KtywPSqcKO5y552DL0C2Ea0Ch:k5GYL6b7mqrKtywv05y552DYC2F5
MD5 SHA1 SHA512 SSDEEP