Malware Analysis Report

2025-08-10 21:21

Sample ID 240527-nsjtbsah97
Target eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe
SHA256 fdecb80962839579c9fa64d60261750101dd87424b003f09a7a82a76515f7307
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

fdecb80962839579c9fa64d60261750101dd87424b003f09a7a82a76515f7307

Threat Level: Shows suspicious behavior

The file eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Checks computer location settings

Deletes itself

Loads dropped DLL

Uses the VBS compiler for execution

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 11:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 11:39

Reported

2024-05-27 11:42

Platform

win7-20240221-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2776 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2776 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2776 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2000 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2000 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2000 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2000 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2776 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe
PID 2776 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe
PID 2776 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe
PID 2776 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3ql4szpw\3ql4szpw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA42B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE8318DB0AF8C4B75976FC2FA20DFB19.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe" C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe

Network

N/A

Files

memory/2776-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

memory/2776-1-0x0000000000030000-0x000000000003A000-memory.dmp

memory/2776-6-0x0000000074A30000-0x000000007511E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3ql4szpw\3ql4szpw.cmdline

MD5 368e21aea10239f9506378c4babefd48
SHA1 eb1159a132ae4195c68a05c37239b40de395eb10
SHA256 1ac5cbe8d7bea4b904172b53f497ab0ceb1a7788bea7d4a4a6cd00036e78aee9
SHA512 8d1bfcbfb337bfb63804342a530f6b5daf0b30e5c801a23c0b9aaae4358c17e42a1bd35b68b5ca14ed33236ed15fa9b766ed91d98a691104a50af1dc9ed768d7

C:\Users\Admin\AppData\Local\Temp\3ql4szpw\3ql4szpw.0.vb

MD5 3adbfc381b68d59e8f4b3d2235477177
SHA1 92f097fb60a90b74bce2904b3d7d17e2ddade609
SHA256 b9fd3edeb43d2c1ac386ab7877cec212424b748dc8dfa8f34beb4aa1421f0f35
SHA512 978e158ec3faeac9f01ad3f5a0d90bba651617f91d74b933998ee9376da4587dfcf8dd2085475a6c8dc8a51e90d6fb81d6b49c4633fb2d4300237f5843467081

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 83e08bdbb9c236adfa11565862dd321c
SHA1 9c99a106a62dd15163323ba1dacf7291490df63a
SHA256 aa673ddbadbae116dd14185ab91d85f83e1abc2e92952840dd7e3a20a0b9332e
SHA512 701b6b06071a9e72e246997a4a91473b57bca8128cca740e499af8533e97e3c15d90037a9d5c8d3f5cedc0463cc59ee132dc1a4c51729e31edf99616fdc8311a

C:\Users\Admin\AppData\Local\Temp\vbcE8318DB0AF8C4B75976FC2FA20DFB19.TMP

MD5 16021916c15af6e38dc93d746fe63ece
SHA1 d2471c97e60573361f6b91b163663f3c2787df6d
SHA256 ab367d1c532b37a538ac5d2cd181f750d901b73c14687940e42d0ad8e9fe0b1d
SHA512 720fa6ea31704bb0f836e02dcf07f61fe169387157888b64c82837e99319d25dfaff64bd5c01533f9c349239b46cee5867096a273a957352e70fca17d5b2dc4d

C:\Users\Admin\AppData\Local\Temp\RESA42B.tmp

MD5 bccc80662453feecd00e7d941373a125
SHA1 9c6e68642af0054b8bba07d2c30c49741ecee11b
SHA256 3733308588462016d991e7ec703afbdcfb036bdcce94688932c98e8824b201ea
SHA512 594ffd2f0644211372cc3ac0bf8e990f1d36103a880666143e28a3762202e6da55f04296b8cfb4733cf596c2a0876489a1266daf9065f907f48f524fd844258b

C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp.exe

MD5 55747dc2a5cb0a237331dd05efaf30e4
SHA1 65216798d3a7a534b37f8989d7e333528a58310d
SHA256 2150217d981f8767e55f27f3fab8b21ddd1f1694b1df301affcd23d61e36c4e3
SHA512 1ce7074263076b60a4598ffe15f0448baca23def45fe9b84ce5d0c5763d5b11a52240e2fa04c0b285823922b71e1bf8d6c613fccf67c5f2b73226facf0d8722e

memory/2776-24-0x0000000074A30000-0x000000007511E000-memory.dmp

memory/2560-23-0x00000000011D0000-0x00000000011DA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 11:39

Reported

2024-05-27 11:42

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3204 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 3204 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 3204 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4484 wrote to memory of 4568 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4484 wrote to memory of 4568 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4484 wrote to memory of 4568 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3204 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe
PID 3204 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe
PID 3204 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cm200l1t\cm200l1t.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5880.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF0EC029CAAC74CC78D1584A9BFE927A.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\eced8197efc825de9bdf0766df90e9b0_NeikiAnalytics.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
NL 23.62.61.137:443 www.bing.com tcp
US 8.8.8.8:53 137.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3204-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

memory/3204-1-0x0000000000C20000-0x0000000000C2A000-memory.dmp

memory/3204-2-0x0000000005590000-0x000000000562C000-memory.dmp

memory/3204-8-0x0000000074AE0000-0x0000000075290000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cm200l1t\cm200l1t.cmdline

MD5 3a0552ca833fd5198762e37509af629d
SHA1 a782b0b5633b50707838897e8f5d651664746ce6
SHA256 c44e0868c738b9da3e8e0bac701a3613f1e1d382a4c0005bffe83911e5a70812
SHA512 6b5328506b27461e3102bc785fc8ebc915ef1506c2978cb2419ee0c1ba8e0d6f2319ada9b1961b6e638b1fc5a6726d27dd98adad6bd1bc691231661842ca0d3a

C:\Users\Admin\AppData\Local\Temp\cm200l1t\cm200l1t.0.vb

MD5 3e8c9aeb86bdc4cc7db6fc3e1c78c118
SHA1 f3b2343229cb33168a758dbb2317a9ffe2caeb9c
SHA256 4b3126448d4a328ce2f9bda4c3f145c5ff37bdb8135fa06cfd42aeb7537308e5
SHA512 b4fcf0b81bc0a933228f88920fb2a5e34550317b961f8739383dc18077ca018db67e6ae7b0552627dd986043f858061470ab98e40ec0bc20311d5671f75b7a78

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 8817843f33de873b351ca888d467c440
SHA1 52907f2f6dc148cadebd27ba0be94d802bc23637
SHA256 3a442b613fc0177ec90462213582e033ab639e7af6eab73ec6431d3f44ccfc96
SHA512 57b2f39cc6c38d62bb1b4e464fba7815d582c2c3944ae147f56a113912281e593f4ff11c30864b31986b80816922d36b0616c3b771b8543a895c57a3fc17bea3

C:\Users\Admin\AppData\Local\Temp\vbcF0EC029CAAC74CC78D1584A9BFE927A.TMP

MD5 a8f96969610fba30e82ba16ae7217d44
SHA1 cb8709d5fcef2b797e755b7364287d8a2673bfb0
SHA256 48167fd1730beb0e51d97cd7fafe56520e1a078fde0e42fd22ac4b819d14651a
SHA512 c9b22c670b0f4605e0e59cb08c7b6b098e243a2b332560a165caba306e22794d7a35ed051713f6d9225d63fb12f505aeb0a3e6871055e4b47ca3b2f68e6b6e55

C:\Users\Admin\AppData\Local\Temp\RES5880.tmp

MD5 6d1685827c16dfb6460d22b04026b92e
SHA1 594eae888630b2d5361283f29ffa2dc4c5d60006
SHA256 fcf4729bd483f8890db74ec2cbf0999e34adf0f977c7f4fccc69abdd6ddf8a4c
SHA512 fa48c1f5e8732c00904ef1da6e8f10f9d42c85d26f90239eec5167a23ca0fb36443088cb71bf1f36f4159643bf756e5ce33356235afc7b976658b33a11dc759c

C:\Users\Admin\AppData\Local\Temp\tmp564F.tmp.exe

MD5 35ee58845e17e86b91b383e0a3e934f9
SHA1 0b1dfb86005e1179a15b05df14e70ff30b5490a1
SHA256 c4d2984598ee7ad8429c81887cccfe13302ddb3340f99f908ccc536e38560066
SHA512 e87f7d6ba9c21a2f1d98fbc8871482be4a3ede2e93a1db1ca970945e33e7f5081a544957e168ad7fed306d1157b963801d0bfcd10b7fd1b038ba09a7bdb19a61

memory/1096-24-0x0000000074AE0000-0x0000000075290000-memory.dmp

memory/1096-25-0x00000000006F0000-0x00000000006FA000-memory.dmp

memory/3204-26-0x0000000074AE0000-0x0000000075290000-memory.dmp

memory/1096-27-0x00000000055F0000-0x0000000005B94000-memory.dmp

memory/1096-28-0x00000000050E0000-0x0000000005172000-memory.dmp

memory/1096-30-0x0000000074AE0000-0x0000000075290000-memory.dmp