Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
27/05/2024, 13:16
General
-
Target
a7533fe4f7c1c4daafe937767b5fa850_NeikiAnalytics.exe
-
Size
62KB
-
MD5
a7533fe4f7c1c4daafe937767b5fa850
-
SHA1
53071afd551f2377f72b409979434027fff58122
-
SHA256
978f831e3ebb60e21da24e089c7d11833de1a778256bd2e5f503863c6562ed65
-
SHA512
d4489db9c8ec6ea5fc32dda6a31c6cad2bccd5bf9182b6b263cebe900771f7d7a75d0ae2031598619158aa09540fbbdd33008517a4c86c4d572fd3c811fb90cf
-
SSDEEP
1536:h2LvvcGJBixuW7dPjQlfSFIsO+aOKcLllWLM2:h2zcGJBibDJvMM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7533fe4f7c1c4daafe937767b5fa850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a7533fe4f7c1c4daafe937767b5fa850_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a7533fe4f7c1c4daafe937767b5fa850_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2KB
MD52c6ce160cea6ccec0f10dfdc2f6e12cb
SHA1fefb5fa788e029df4ff6309fd8d60411803f29a9
SHA2561719a9fdd300513ab1bfb45897dfd37bbd7ee8209db5f422e4af8779a4051204
SHA5120a31469ca5fce4ce1fd4ca9956cbe6400c47cbad8d3c360f1750c50b1563a84ae8e7d5d83e2b5799b0596863c77b480b67859661b496e53083b4564280dbad0a
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
76KB
-
Filesize
8KB