Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 08:23

General

  • Target

    4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe

  • Size

    12KB

  • MD5

    4cba71691b8bc14345aa4dc0baced850

  • SHA1

    86205dac169f33d4f8266eb9d3b199bb5d54eb55

  • SHA256

    1614d4f29b90108fb81d661dbc8a23054e05916be3f1f10fb2cc92c28b8fa540

  • SHA512

    ac11b286f86e96198fcf7fbb4f8e314fc04c884131310cf4075728762fc4d4fcd26663f7e4dbcf885a6818e36eb7bfee769f432ea6096e1da493218170b5feb1

  • SSDEEP

    384:1L7li/2ztq2DcEQvdhcJKLTp/NK9xa/ar1:VlM/Q9c/2

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y0uz5btg\y0uz5btg.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES93E3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc40C896F462E541AF88CF5CAAC13F31D1.TMP"
        3⤵
          PID:4976
      • C:\Users\Admin\AppData\Local\Temp\tmp9192.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp9192.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4cba71691b8bc14345aa4dc0baced850_NeikiAnalytics.exe
        2⤵
        • Deletes itself
        • Executes dropped EXE
        PID:876

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\RE.resources

            Filesize

            2KB

            MD5

            507b7a3423d21c48cf075fe17e385256

            SHA1

            2fd8e4f388b1f2afe559e9bbb080e52abd946ac5

            SHA256

            efeccdd0122c3fc4cda7874a20c78e70135f35c476e3531ef746b01a7e722935

            SHA512

            23cf74478e267d2f975f6586468dc1492e10b51190ad80cb5fe7d7ee0836d77ed3f3a0b363fcd6679f3c829defd6bb6ced0fabbabd9145d55ff9b669efce85fe

          • C:\Users\Admin\AppData\Local\Temp\RES93E3.tmp

            Filesize

            1KB

            MD5

            fa90ef308f770c5de6b4dc21286b2b42

            SHA1

            7f948fad6a74ba7e56e400ba7b8fc3d7f1e989a2

            SHA256

            f4afc189b6386b93645587fc29d868dcf046cc10caca6a31b88daff22348c1f0

            SHA512

            1af6ba24782cc42b004ddee99c82dbe9ab3d32ea24ed4ac4051d8bbb2e859e2339625065616d0e6734e4753c1415c7c6fa81e2344d0b95dda2a7733868299eed

          • C:\Users\Admin\AppData\Local\Temp\tmp9192.tmp.exe

            Filesize

            12KB

            MD5

            04fce4dbc4f5dbbcdcb6b48a4dbb9e35

            SHA1

            8cdd58e2c29f96b9392928a9f6cdd36132deee67

            SHA256

            41145d035da0fee193d74d5920fead57bb4af13f4c24c2f27dce8086684f8ed7

            SHA512

            77a06855ef9418cd2dd1c51ed151a6891c8d3849d1331ca2c3f08e08915314fc39f5e37ee9090c5101e4172a7a11830fe5a78f139a28a509a319cc179adaac38

          • C:\Users\Admin\AppData\Local\Temp\vbc40C896F462E541AF88CF5CAAC13F31D1.TMP

            Filesize

            1KB

            MD5

            1ad4d5540a1e5a64c58750df3e54aae8

            SHA1

            f0c3c45ce926c78b323f09b57cf6cacb41d3ea4d

            SHA256

            5d7d6ed50d2b73b8a554f887ab3985321f054dff7c8aecd147a9115baea8d098

            SHA512

            2b4477d537a9693937ecf78fe7e5aca41a541033ee87980bc0ae1c11b763fc04b3737d4546e81484994122e73d3c23964891ba915047249fc9a9670fd9840b36

          • C:\Users\Admin\AppData\Local\Temp\y0uz5btg\y0uz5btg.0.vb

            Filesize

            2KB

            MD5

            0a0272f463e1edfa08a6cb20c2868c57

            SHA1

            0b6a78e086f65d05a59f203ffeae49b1f04eb870

            SHA256

            51b73e371321c2f70a871b54dd2e97be76cd7005427d9331cd9b43165c55a34f

            SHA512

            8520d68cdc5b54c913d45eb50a9d646837c435bdb4266b171f5b0bdc9a6da200d96522a01360532026cd00f8070b7d06d21a214d21ed698de73e27e6b4234ea4

          • C:\Users\Admin\AppData\Local\Temp\y0uz5btg\y0uz5btg.cmdline

            Filesize

            273B

            MD5

            da580bc98c0c556618567d5c3246c564

            SHA1

            01b5834c60034497f215d0568a980f1d2ba06c9d

            SHA256

            17665eb9b47e04076f5d802ae7ff604aadcb4f6d83d20257d3674cce8390eba4

            SHA512

            5ff66e3b21933eabb85e7e14ce908cd2b0774a63db1a8e1f5609051fca9140302753cbb9274aa6e6e3bf76b9a7c8e60648aca41527635ad9867650d860aca8ba

          • memory/60-0-0x000000007481E000-0x000000007481F000-memory.dmp

            Filesize

            4KB

          • memory/60-8-0x0000000074810000-0x0000000074FC0000-memory.dmp

            Filesize

            7.7MB

          • memory/60-2-0x0000000005430000-0x00000000054CC000-memory.dmp

            Filesize

            624KB

          • memory/60-1-0x0000000000A50000-0x0000000000A5A000-memory.dmp

            Filesize

            40KB

          • memory/60-24-0x0000000074810000-0x0000000074FC0000-memory.dmp

            Filesize

            7.7MB

          • memory/876-25-0x0000000074810000-0x0000000074FC0000-memory.dmp

            Filesize

            7.7MB

          • memory/876-26-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

            Filesize

            40KB

          • memory/876-27-0x0000000005EF0000-0x0000000006494000-memory.dmp

            Filesize

            5.6MB

          • memory/876-28-0x00000000059E0000-0x0000000005A72000-memory.dmp

            Filesize

            584KB

          • memory/876-30-0x0000000074810000-0x0000000074FC0000-memory.dmp

            Filesize

            7.7MB