Analysis
-
max time kernel
147s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 11:39
Behavioral task
behavioral1
Sample
58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
-
Size
134KB
-
MD5
58b672f36e71251b2192f2e19baec830
-
SHA1
25051d80782fa6cda0c17b43fe072622e7cbc8b9
-
SHA256
3c621489d42f95481cd99461ba5d9d88eb6767f3fbdd0481001aaa81bd4ce196
-
SHA512
83634cfdd3d5fed6a01e8bd05074b802cf5021c1ed50d8fb09e6ca968876c4cf7e6155ce8fed80010d5004df5f91dcace5e13d35b62d391a0d715fcc3f7fbcc2
-
SSDEEP
1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOl:YfU/WF6QMauSuiWNi9eNOl0007NZIOl
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 4140 wuauclt.exe -
resource yara_rule behavioral2/memory/4760-0-0x0000000000A30000-0x0000000000A58000-memory.dmp upx behavioral2/files/0x000900000002341a-3.dat upx behavioral2/memory/4140-5-0x0000000000910000-0x0000000000938000-memory.dmp upx behavioral2/memory/4760-6-0x0000000000A30000-0x0000000000A58000-memory.dmp upx behavioral2/memory/4140-7-0x0000000000910000-0x0000000000938000-memory.dmp upx behavioral2/memory/4760-8-0x0000000000A30000-0x0000000000A58000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run" 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4140 4760 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 83 PID 4760 wrote to memory of 4140 4760 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 83 PID 4760 wrote to memory of 4140 4760 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 83 PID 4760 wrote to memory of 752 4760 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 94 PID 4760 wrote to memory of 752 4760 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 94 PID 4760 wrote to memory of 752 4760 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\ProgramData\Update\wuauclt.exe"C:\ProgramData\Update\wuauclt.exe" /run2⤵
- Executes dropped EXE
PID:4140
-
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe" >> NUL2⤵PID:752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD51c1e8bb0e454079e1e4679975d4c6964
SHA1184838517d5feff5975cbaeb1ab1c1d53c1301d7
SHA2560961e8b6b392f2af1a7205388d536d091139d4bd9a1b79659d6eb1dd67ca72b4
SHA512e8f1ba10c598266da9ed5b4450691881fd6f8cb906009b113d01faaca8d3e287c77e4d879fe6dea6dc0071a7f16a8250e2906f305428156da9a41d59ecac045d