9a61071ee2f9b1bd08aab806c9fe9c04f19d948837d4f8bbcb0b5b9bc74f145c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03049699c2b2b2a40b33c6610b928860_NeikiAnalytics.exe
Size

45KB
MD5

03049699c2b2b2a40b33c6610b928860
SHA1

cfd2483f7e404c728c5e67de38808b982a63cf24
SHA256

9a61071ee2f9b1bd08aab806c9fe9c04f19d948837d4f8bbcb0b5b9bc74f145c
SHA512

ae372d23045f844f04101263ff571c750f790bf3990acc72993bc19357c9ccbaad497cd3d8f47384e51e293abb4914f5a800af0609e69cbf33c1aa4a6f45455e
SSDEEP

768:6z2P7j8YtdwYGcizNexgteflIAoHNV2XBFV72h4lA7Z8EWWuM17tnwvs9aIHS6U8:6yP7YYtdwYGcizNexgteflIAoHNV2XBo

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	03049699c2b2b2a40b33c6610b928860_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3212	realupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3212	3412	03049699c2b2b2a40b33c6610b928860_NeikiAnalytics.exe	82
PID 3412 wrote to memory of 3212	3412	03049699c2b2b2a40b33c6610b928860_NeikiAnalytics.exe	82
PID 3412 wrote to memory of 3212	3412	03049699c2b2b2a40b33c6610b928860_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\03049699c2b2b2a40b33c6610b928860_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\03049699c2b2b2a40b33c6610b928860_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\realupdater.exe

Filesize
46KB

MD5
54ec95ce6b704333768f97ab69b3cedc

SHA1
df802a943877d7eae22132c97c75e99aeece8cce

SHA256
d5409452302ba98d521f7dbc16a3108a65cfc0bf979af6b0b253c7d978393b51

SHA512
95ada09a0227171c95384f9bdc8760415bf8b056811ee58b97723155554f84b473639d86a08507287bd28ca9d7a45f61bb3202e5f1cbf4d8b075d0e050975a3b

Download Submit
memory/3212-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3412-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download