Analysis

  • max time kernel
    147s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 11:39

General

  • Target

    58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    58b672f36e71251b2192f2e19baec830

  • SHA1

    25051d80782fa6cda0c17b43fe072622e7cbc8b9

  • SHA256

    3c621489d42f95481cd99461ba5d9d88eb6767f3fbdd0481001aaa81bd4ce196

  • SHA512

    83634cfdd3d5fed6a01e8bd05074b802cf5021c1ed50d8fb09e6ca968876c4cf7e6155ce8fed80010d5004df5f91dcace5e13d35b62d391a0d715fcc3f7fbcc2

  • SSDEEP

    1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOl:YfU/WF6QMauSuiWNi9eNOl0007NZIOl

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\ProgramData\Update\wuauclt.exe
      "C:\ProgramData\Update\wuauclt.exe" /run
      2⤵
      • Executes dropped EXE
      PID:4140
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe" >> NUL
      2⤵
        PID:752

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Update\wuauclt.exe

            Filesize

            134KB

            MD5

            1c1e8bb0e454079e1e4679975d4c6964

            SHA1

            184838517d5feff5975cbaeb1ab1c1d53c1301d7

            SHA256

            0961e8b6b392f2af1a7205388d536d091139d4bd9a1b79659d6eb1dd67ca72b4

            SHA512

            e8f1ba10c598266da9ed5b4450691881fd6f8cb906009b113d01faaca8d3e287c77e4d879fe6dea6dc0071a7f16a8250e2906f305428156da9a41d59ecac045d

          • memory/4140-5-0x0000000000910000-0x0000000000938000-memory.dmp

            Filesize

            160KB

          • memory/4140-7-0x0000000000910000-0x0000000000938000-memory.dmp

            Filesize

            160KB

          • memory/4760-0-0x0000000000A30000-0x0000000000A58000-memory.dmp

            Filesize

            160KB

          • memory/4760-6-0x0000000000A30000-0x0000000000A58000-memory.dmp

            Filesize

            160KB

          • memory/4760-8-0x0000000000A30000-0x0000000000A58000-memory.dmp

            Filesize

            160KB