2b043402795f42820a17e91e70efa28d11c3e35784a7157f84454fbdc27213fe

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6dbbcf30b2278c3bda50bcfc0d008840_NeikiAnalytics.exe
Size

36KB
MD5

6dbbcf30b2278c3bda50bcfc0d008840
SHA1

8f75936b32934e15418740db4eba8ce5dac7f9a9
SHA256

2b043402795f42820a17e91e70efa28d11c3e35784a7157f84454fbdc27213fe
SHA512

1513ad0282caa8728027e652591d631a659188fc1b98d2bc0386e0ae78aa1cbf3a55052feb2045b7adb8e6ff52edb753c99e0a913b8b4f3486ccabc7066003d3
SSDEEP

768:U5ZFhzgxucryOmJQqO3VhDWiNlW+O96QhlqNU9jz8V:U57mucrFmJQqO3VhDWiC+i6QnjYV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	6dbbcf30b2278c3bda50bcfc0d008840_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2940	hhcbrnaff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2940	2356	6dbbcf30b2278c3bda50bcfc0d008840_NeikiAnalytics.exe	85
PID 2356 wrote to memory of 2940	2356	6dbbcf30b2278c3bda50bcfc0d008840_NeikiAnalytics.exe	85
PID 2356 wrote to memory of 2940	2356	6dbbcf30b2278c3bda50bcfc0d008840_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\6dbbcf30b2278c3bda50bcfc0d008840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6dbbcf30b2278c3bda50bcfc0d008840_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
  "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
  2⤵
  - Executes dropped EXE
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

Filesize
36KB

MD5
a10d0655b31e0fe32977aca0f1f57fcb

SHA1
0e4b90eb68993dd87bbdadff59e55acac42331a4

SHA256
c7af048722710a36f38ba2fe0c77983b68df06a629afe5fe2f8942b314b7caac

SHA512
5dea81931c026140920abee05597f979be18ea2089c6a03be643611b871244796b91e582abc21a5387a41013a062b414d389973a41213d5608d55a9e15dedbaf

Download Submit
memory/2356-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2356-2-0x0000000000920000-0x0000000000926000-memory.dmp

Filesize
24KB

Download
memory/2356-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2940-11-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download