11d19b36b4c252236771151161f899e2031156da7818b98db4b0301f5a1dae71

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b068950e6b869b40420b8965cd097d0_NeikiAnalytics.exe
Size

5KB
MD5

7b068950e6b869b40420b8965cd097d0
SHA1

e8475d1f93acb6860fc21327d9a07f21e3bf7c08
SHA256

11d19b36b4c252236771151161f899e2031156da7818b98db4b0301f5a1dae71
SHA512

3045e6c7d445374eb7bb27c9061fbdf33665d1f29a3358d22ca3ca07a900caadd62c75c35422132c8b83e2e1fff419f45fa833ad752fd67c42eaeaa8266b928f
SSDEEP

48:6hecL4Tct69GpIvLHmCyYA+qH6RZrdUzEVnQBG/RACalGUx2CS7DD:Q8YtFIvLGaANHadwAnQWRRUx2CqD

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	updGA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7b068950e6b869b40420b8965cd097d0_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
684	updGA.exe

Executes dropped EXE 1 IoCs

pid	Process
684	updGA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 684	964	7b068950e6b869b40420b8965cd097d0_NeikiAnalytics.exe	92
PID 964 wrote to memory of 684	964	7b068950e6b869b40420b8965cd097d0_NeikiAnalytics.exe	92
PID 964 wrote to memory of 684	964	7b068950e6b869b40420b8965cd097d0_NeikiAnalytics.exe	92

C:\Users\Admin\AppData\Local\Temp\7b068950e6b869b40420b8965cd097d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7b068950e6b869b40420b8965cd097d0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\updGA.exe
  "C:\Users\Admin\AppData\Local\Temp\updGA.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\seomat.exe

Filesize
2KB

MD5
972a8b03ddd86499754190f4a1e2ec95

SHA1
3274cf3d13f1190a17d1f86203c91676267fdd50

SHA256
02299743f544c22427c85d1d55a1baf57523eaad7d9412f8e15b420f7dd6b155

SHA512
252e17d8f1a924093e42150bb920184c654516cacc939af8786d282a15848396b7404b78d021b4eeeb20c09117be5ff5d2fdc53d826113f97f6f7b846af80c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\updGA.exe

Filesize
5KB

MD5
1c64181d94616eab91013aa4b56fb15f

SHA1
7ab9dfa8151e241b64221a1fb12ab6f9b7d41e20

SHA256
7e86d67cfa590aadbcd534e49bf764cf11f47cc578b65f81acfd1d49fb12d82b

SHA512
5def0f71dcced6ccbf0e90021d397c8330d3c9ccd398064a7876af0cd3fcc8d3d5e1a9f87f8fbeede84b83af1f1acd5dcf1780d730f47fb2e8ee27fe2b3718ac

Download Submit