Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe
-
Size
12KB
-
MD5
4cba71691b8bc14345aa4dc0baced850
-
SHA1
86205dac169f33d4f8266eb9d3b199bb5d54eb55
-
SHA256
1614d4f29b90108fb81d661dbc8a23054e05916be3f1f10fb2cc92c28b8fa540
-
SHA512
ac11b286f86e96198fcf7fbb4f8e314fc04c884131310cf4075728762fc4d4fcd26663f7e4dbcf885a6818e36eb7bfee769f432ea6096e1da493218170b5feb1
-
SSDEEP
384:1L7li/2ztq2DcEQvdhcJKLTp/NK9xa/ar1:VlM/Q9c/2
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe -
Deletes itself 1 IoCs
pid Process 876 tmp9192.tmp.exe -
Executes dropped EXE 1 IoCs
pid Process 876 tmp9192.tmp.exe -
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 60 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 60 wrote to memory of 3032 60 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe 86 PID 60 wrote to memory of 3032 60 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe 86 PID 60 wrote to memory of 3032 60 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe 86 PID 3032 wrote to memory of 4976 3032 vbc.exe 89 PID 3032 wrote to memory of 4976 3032 vbc.exe 89 PID 3032 wrote to memory of 4976 3032 vbc.exe 89 PID 60 wrote to memory of 876 60 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe 90 PID 60 wrote to memory of 876 60 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe 90 PID 60 wrote to memory of 876 60 4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y0uz5btg\y0uz5btg.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES93E3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc40C896F462E541AF88CF5CAAC13F31D1.TMP"3⤵PID:4976
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp9192.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9192.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
PID:876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5507b7a3423d21c48cf075fe17e385256
SHA12fd8e4f388b1f2afe559e9bbb080e52abd946ac5
SHA256efeccdd0122c3fc4cda7874a20c78e70135f35c476e3531ef746b01a7e722935
SHA51223cf74478e267d2f975f6586468dc1492e10b51190ad80cb5fe7d7ee0836d77ed3f3a0b363fcd6679f3c829defd6bb6ced0fabbabd9145d55ff9b669efce85fe
-
Filesize
1KB
MD5fa90ef308f770c5de6b4dc21286b2b42
SHA17f948fad6a74ba7e56e400ba7b8fc3d7f1e989a2
SHA256f4afc189b6386b93645587fc29d868dcf046cc10caca6a31b88daff22348c1f0
SHA5121af6ba24782cc42b004ddee99c82dbe9ab3d32ea24ed4ac4051d8bbb2e859e2339625065616d0e6734e4753c1415c7c6fa81e2344d0b95dda2a7733868299eed
-
Filesize
12KB
MD504fce4dbc4f5dbbcdcb6b48a4dbb9e35
SHA18cdd58e2c29f96b9392928a9f6cdd36132deee67
SHA25641145d035da0fee193d74d5920fead57bb4af13f4c24c2f27dce8086684f8ed7
SHA51277a06855ef9418cd2dd1c51ed151a6891c8d3849d1331ca2c3f08e08915314fc39f5e37ee9090c5101e4172a7a11830fe5a78f139a28a509a319cc179adaac38
-
Filesize
1KB
MD51ad4d5540a1e5a64c58750df3e54aae8
SHA1f0c3c45ce926c78b323f09b57cf6cacb41d3ea4d
SHA2565d7d6ed50d2b73b8a554f887ab3985321f054dff7c8aecd147a9115baea8d098
SHA5122b4477d537a9693937ecf78fe7e5aca41a541033ee87980bc0ae1c11b763fc04b3737d4546e81484994122e73d3c23964891ba915047249fc9a9670fd9840b36
-
Filesize
2KB
MD50a0272f463e1edfa08a6cb20c2868c57
SHA10b6a78e086f65d05a59f203ffeae49b1f04eb870
SHA25651b73e371321c2f70a871b54dd2e97be76cd7005427d9331cd9b43165c55a34f
SHA5128520d68cdc5b54c913d45eb50a9d646837c435bdb4266b171f5b0bdc9a6da200d96522a01360532026cd00f8070b7d06d21a214d21ed698de73e27e6b4234ea4
-
Filesize
273B
MD5da580bc98c0c556618567d5c3246c564
SHA101b5834c60034497f215d0568a980f1d2ba06c9d
SHA25617665eb9b47e04076f5d802ae7ff604aadcb4f6d83d20257d3674cce8390eba4
SHA5125ff66e3b21933eabb85e7e14ce908cd2b0774a63db1a8e1f5609051fca9140302753cbb9274aa6e6e3bf76b9a7c8e60648aca41527635ad9867650d860aca8ba