3fac860c4d0ad26814e8ec13db96454f734ed47b34a38c2d248584d270d6e406

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe
Size

30KB
MD5

dcedfaac71341b86e1b4e974a5105f10
SHA1

4a67463f377d59b421656964bc0815721c83b234
SHA256

3fac860c4d0ad26814e8ec13db96454f734ed47b34a38c2d248584d270d6e406
SHA512

2e42584ad5ed768581aa8b43ebb9d95afd9b48b8adea3bab816041c3f82be39a1dfe8738c2f0fdd3b960fbfad26a11c58a8c662a3bc54ba94c237839cd3d3af0
SSDEEP

384:iTjB4f0y4lSqCHHffYZ5SKNOI5pbzCZYCKdKj+RYS9ON2tSUCu8FoE692yor:Q406H/0PbzCdj+Rh9OotSbxFTGtk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2200	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2200	4800	dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe	83
PID 4800 wrote to memory of 2200	4800	dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe	83
PID 4800 wrote to memory of 2200	4800	dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
30KB

MD5
e6a93b6167735fb2e60fbd827df0279b

SHA1
d887ebec9dac0e744c6fedb683caeee36d1545cc

SHA256
7d07641528f81bdaa085d042be4fc5ab235da84ebd389b118d3b10957d552915

SHA512
0efd850934c6dedfa96fccb312237677cb6349a3dc6e9cd30ade471b80b2460655d72e1bc6f33004ad5878f6c409b816da84da6f281a1403a4506e4dee7f865f

Download Submit