3a21b19c54a800304611f84f82837ced519a1410fd3b70f19197352fbbbc08c6

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe
Size 12KB
Sample240529-jpb7vsgc93
SHA256 3a21b19c54a800304611f84f82837ced519a1410fd3b70f19197352fbbbc08c6
MD5 4b7a3ce694da822b1891f11d2fc34030
SHA1 681027a9e558942768af934da40e54ef3fea9ad4
SHA512 7b8e4c7120ae7147260a188b753ae084e59d03b3276fbd5ee3c0e1d0d56aacd326fb41c661c1c0aef9bb8f48079f7e5236dd5785f8fe6eef298ac9212159e86a
SSDEEP 384:sL7li/2zPq2DcEQvdhcJKLTp/NK9xa8k:qLM/Q9c8k
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
4876	tmp39CE.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4876	tmp39CE.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 1488	4676	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe	85
PID 4676 wrote to memory of 1488	4676	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe	85
PID 4676 wrote to memory of 1488	4676	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe	85
PID 1488 wrote to memory of 2020	1488	vbc.exe	87
PID 1488 wrote to memory of 2020	1488	vbc.exe	87
PID 1488 wrote to memory of 2020	1488	vbc.exe	87
PID 4676 wrote to memory of 4876	4676	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe	88
PID 4676 wrote to memory of 4876	4676	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe	88
PID 4676 wrote to memory of 4876	4676	4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vgbak4it\vgbak4it.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B82.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBC5B626B3BC94E67BE32AF6F0BFC039.TMP"
    3⤵
    PID:2020
- C:\Users\Admin\AppData\Local\Temp\tmp39CE.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp39CE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4b7a3ce694da822b1891f11d2fc34030_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 2e2fc845a35b69e0166a155f885c30a98fe21b05d3d543b2fb1a3ba7830d4a9e
MD5 ac8b851ef8b0ec7664bd387faea83373
SHA1 38fdd49b7cc1afe9429ff078ffbd38feadf16063
SHA512 4c7eb282db3c387e1001ba542d4c38c92bb9260470db8497126e62e24b39c0c362feba7865ff64494e093391b8e0528d14ac93b021e60910508d591032ec7623
MD5 SHA1 SHA512

Submit Download

RES3B82.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3B82.tmp
Size 1KB
SHA256 1224e528ad4bbb9c89242a9df7eae489d457614b2aa5774047a457e2748825a0
MD5 7410bfcaf748a2f8b73f8a118b526764
SHA1 dcd5e00b882010b8a1c330e8aaf688cd07085293
SHA512 19005b77f35ab852bd037e3903fca3ae22a5f291d2178e93cec9a25b6b7087d81affdbdd9f1a9aee71369c8fcd78fb6c599422da589a82089f78fcb0674dad76
MD5 SHA1 SHA512

Submit Download

tmp39CE.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp39CE.tmp.exe
Size 12KB
SHA256 c3f2126461a78bf73174bcdc0047a1b7e5ef45ff5648bcc5f1bd77738601fcb4
MD5 a0818b69adc77692271ea9f2d662d88d
SHA1 126d615adeea921b34d857944fd5228490ec32f8
SHA512 c43d607bcf65aaa950d43db6336fcdbf67184bb52010fa03b391c30946269a442bd9677effc86d7adbcc46d09e4133f17a93ec50daa473bbbe2bd8d12cb82ed4
SSDEEP 384:CL7li/2zfq2DcEQvdfcJKLTp/NK9xaM0:czMZQ9cM0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcBC5B626B3BC94E67BE32AF6F0BFC039.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcBC5B626B3BC94E67BE32AF6F0BFC039.TMP
Size 1KB
SHA256 07cc9d2c277d524b101ba70f7c3380795305d41a38854d43261b36cef0d5819b
MD5 f4dd55e47f5fbdff06ec9ce3096f2557
SHA1 ea2ea68d95afee99bec325e027fc049b045c642e
SHA512 7881288252ed5c441869572d0c67d7f3f45057a82c084032291a743de6105c460207b5c188cd7b25a2512f8c131860af5e9640f7aee7c92b1f9f71afea499202
MD5 SHA1 SHA512

Submit Download

vgbak4it.0.vb

Path C:\Users\Admin\AppData\Local\Temp\vgbak4it\vgbak4it.0.vb
Size 2KB
SHA256 dfa24b613b574698345085cbc65a0651268fb625cadeedc26cabff59da5f21b1
MD5 a5442b9c08165666a1cf8ee3790ad0a2
SHA1 c33cfa1b97e6f0f21455882f73ecb38d9318a246
SHA512 5a092ac08c212a8dd46a8ec7ff03ee855f80c1522595d0c5aa4a69f0b8b1d20059eaf578dc09ee7157bc5f604aec0b557d4fad8d5e14fbc9f8af10952fe3873f
MD5 SHA1 SHA512

Submit Download

vgbak4it.cmdline

Path C:\Users\Admin\AppData\Local\Temp\vgbak4it\vgbak4it.cmdline
Size 273B
SHA256 073266c933218c3b5a2091244a5d1013b75052ceecfed86dfc4167d6b866389a
MD5 38f64d0d1470dfb22c227082639fb183
SHA1 6cde12b68f1b51a1b1ffcf2f80ad2d6668646e69
SHA512 a7f633297c4447ffd3dbcedf115a6158d3cb4ff15cc5e63a46ebaff8bc45110b49c25d0d58381ef7492ab2342e451c395d8fbdad06320143f791ee23be72a7f0
MD5 SHA1 SHA512

Submit Download

memory/4676-0-0x00000000748BE000-0x00000000748BF000-memory.dmp

Download

memory/4676-8-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

memory/4676-2-0x00000000052C0000-0x000000000535C000-memory.dmp

Download

memory/4676-1-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Download

memory/4676-24-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

memory/4876-25-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

memory/4876-26-0x0000000000DF0000-0x0000000000DFA000-memory.dmp

Download

memory/4876-27-0x0000000005D90000-0x0000000006334000-memory.dmp

Download

memory/4876-28-0x00000000057E0000-0x0000000005872000-memory.dmp

Download

memory/4876-30-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads