5e2c2e6e156fb9b602c05954dd3cb6b778b5154d684fa549eb5dd6ea666af153

Analysis

max time kernel
149s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe
Size

22KB
MD5

aeb75dc0b759e1a5f4cff9bff55ace50
SHA1

39156cbd227f99b2795fcbd45ab4d766a6917c1b
SHA256

5e2c2e6e156fb9b602c05954dd3cb6b778b5154d684fa549eb5dd6ea666af153
SHA512

bafb80caf25f55fe300eb94fcc1f66eac4bbf02bd27222cef3da4bf908d26cbf3bb2da8846bb25802dbcb4d9a33ef67f271a62c7f87dae6727517413f5acc115
SSDEEP

192:qytgAeuB2S7FFWlSkABcI+EWL/hTUozHLYDo2SIcIn8/wKUlT8AF8rV3u:qySFpcI5pTUo7L2FSmnmwKUl4AF8rY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1324	cchip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1324	2532	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe	83
PID 2532 wrote to memory of 1324	2532	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe	83
PID 2532 wrote to memory of 1324	2532	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\cchip.exe
  "C:\Users\Admin\AppData\Local\Temp\cchip.exe"
  2⤵
  - Executes dropped EXE
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cchip.exe

Filesize
22KB

MD5
2d57db14290f333596aead06582d1d1f

SHA1
4a5d4f9f47a2f4b3023507f87106ef3e549d1ced

SHA256
393cd1aaeb77c689757b1390682076aba5911544bc726a0e4860ddd21e778efe

SHA512
7e50767afa74cf054cc26a862962905507ac078d05db9682fe0ea76ce4dbee6024f9122c8989a85cd31f812509ac062fb35c1940e79438505f0756234f68004f

Download Submit
memory/1324-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2532-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download