801952352601ac841e0a103d818a208100fd072e2cbb96fb043536077fc558d5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 21:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02d24b3e3968029bff0a6e6e08470df0_NeikiAnalytics.exe
Size

36KB
MD5

02d24b3e3968029bff0a6e6e08470df0
SHA1

3cf8bd7ea254ad8c429e29f971a30fd0920dc82b
SHA256

801952352601ac841e0a103d818a208100fd072e2cbb96fb043536077fc558d5
SHA512

563deeb5648c715dcf5401851c37c9a2a2b1ac1dd10097caeb653cfd33125ee67a2aa44c8eeb8b5d381102973b0b0661d9a142c109e9ef4e1fa7bc7f908f1f88
SSDEEP

768:U5ZFhzgxucryOmJQqO3VhDWiNlW+O96QhlqNU9ju:U57mucrFmJQqO3VhDWiC+i6Qnju

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	02d24b3e3968029bff0a6e6e08470df0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1752	hhcbrnaff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1752	972	02d24b3e3968029bff0a6e6e08470df0_NeikiAnalytics.exe	82
PID 972 wrote to memory of 1752	972	02d24b3e3968029bff0a6e6e08470df0_NeikiAnalytics.exe	82
PID 972 wrote to memory of 1752	972	02d24b3e3968029bff0a6e6e08470df0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\02d24b3e3968029bff0a6e6e08470df0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\02d24b3e3968029bff0a6e6e08470df0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
  "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
  2⤵
  - Executes dropped EXE
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

Filesize
36KB

MD5
7190511400bfa97c17bbc11a9ea6cae7

SHA1
c02c742ab6425add3ced443c56c2d039944dc832

SHA256
1b1e62f41d6c4ed4a4137638897e726aecd933470207d10f514bd7d5eb6c4650

SHA512
0a7ae8b924d6cc79e9d715f35cb46c7d35b199c299774ed9dd2934ec9815358bb1465c8a1f69359d41bd19ab280f4c718e34f0dd7cafb011984c793c7df98060

Download Submit
memory/972-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/972-2-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/972-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1752-11-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download