64a98e57ef0157c33b6fdd5971568db898dbbf29d89cf5cca0e026881207ce9c

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe
Size 12KB
Sample240529-mk2thabf3w
SHA256 64a98e57ef0157c33b6fdd5971568db898dbbf29d89cf5cca0e026881207ce9c
MD5 515a6847016f2887be723fd0e9020c60
SHA1 9347f19dbf1afd30d4ae748ae5eea8a539a3d21f
SHA512 3f1c0d23c74fe094745b25ea59a32a3648a7d93832fb4103fa104e556193b8912e1b77e2edd10a62c23412b98a692dcf07bfc55827a71e31d94f908dba8d4c1d
SSDEEP 384:iL7li/2zIq2DcEQvdQcJKLTp/NK9xaj0m:8cMCQ9cYm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
4132	tmp4C8B.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4132	tmp4C8B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3640	2664	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe	88
PID 2664 wrote to memory of 3640	2664	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe	88
PID 2664 wrote to memory of 3640	2664	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe	88
PID 3640 wrote to memory of 4780	3640	vbc.exe	90
PID 3640 wrote to memory of 4780	3640	vbc.exe	90
PID 3640 wrote to memory of 4780	3640	vbc.exe	90
PID 2664 wrote to memory of 4132	2664	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe	91
PID 2664 wrote to memory of 4132	2664	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe	91
PID 2664 wrote to memory of 4132	2664	515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r4h04et3\r4h04et3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAECBDF3696434B49AB7E952D508C5A77.TMP"
    3⤵
    PID:4780
- C:\Users\Admin\AppData\Local\Temp\tmp4C8B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4C8B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\515a6847016f2887be723fd0e9020c60_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 9092cd07f379cb3876f46abcca77572294328942df0e3621474af543a005523d
MD5 5a479f1c7e8ab9c694320a47d287a5c3
SHA1 4cfb0a0d61acac5ed4f4205e3a6881c9a05a1543
SHA512 3bdd0c2deba15d273bc86c4d3b60fd488d216034302ac747e34b7c7de9174417742902ba913e136bee99b5595cd5a68b17d7b7f6f79ce8b41740300b911edec9
MD5 SHA1 SHA512

Submit Download

RES4E4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4E4F.tmp
Size 1KB
SHA256 17554a5c48f713262bceea8d38efbabcbf740fe5f0d575fd92732ccfcc4485a4
MD5 eb3c2f1a1e24a6251eed62c5bdfa6d9c
SHA1 2c976e2161e1da68560996269815e400b5c7b868
SHA512 7f3671922431c06ffa87e1144096d5aafd22a6908b3f689522eb52e2c2689f9ea552a90ccf9438f3db7e564428cd5017ccf64ea41cf71ff30dd9569865497015
MD5 SHA1 SHA512

Submit Download

r4h04et3.0.vb

Path C:\Users\Admin\AppData\Local\Temp\r4h04et3\r4h04et3.0.vb
Size 2KB
SHA256 e3d8e0bb8883076876555d521c9abe4cf0936277dc3c9d1d49eaaa72490f5dea
MD5 0efbb8a33fb6872c0eecfae5cc5ebbcd
SHA1 7aff65935f9e83e931dc02ff29b992f2b9189f85
SHA512 d7e1f9296b5eb9b1b017aa1e91b877763c2b2fd59c44dc9dc97d07615fec04f42be1796da5a352f945ea2d7f750c3f31656e5c3d4e625dd952789cdc33e38ebd
MD5 SHA1 SHA512

Submit Download

r4h04et3.cmdline

Path C:\Users\Admin\AppData\Local\Temp\r4h04et3\r4h04et3.cmdline
Size 273B
SHA256 af9bcf5b67a1521455b48411ed85cc1d4531dda727eddce89f985df08f1b8b72
MD5 c3202565744893c91a6cf03ac103dc00
SHA1 b9bd7a29515aef237be1240c6302794625371fda
SHA512 26770259f2c94f1958a628e6c38d38d468c7da4329a1222c48ab1ff605bb85c0c06facb5990b84bd562e37470458d5734300da7b5c9ae1983aa30d689babe633
MD5 SHA1 SHA512

Submit Download

tmp4C8B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4C8B.tmp.exe
Size 12KB
SHA256 570df8950efe4c967b9e9b92efdc1be2ab81a6e91b6769c5a2d500fac38568c6
MD5 efd2336d52b908ec068769c07c9b168c
SHA1 fc918de0e7dc7b65d7a5ec5774265e03a38e5003
SHA512 281be5d5eec2e014a041775675d8fad0f799593fd49b7e8602dc1dca6ef00142241e679c96ae3e5ca787cfb44d9493bdaac9b8016aa4d46c29f3905af74cd193
SSDEEP 384:VL7li/2zWq2DcEQvdfcJKLTp/NK9xaIf:12MZQ9cIf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcAECBDF3696434B49AB7E952D508C5A77.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcAECBDF3696434B49AB7E952D508C5A77.TMP
Size 1KB
SHA256 744030e95e3e01f34379c36ce5fac4e47b740cdccc5e884186f2c78fba53dbe6
MD5 944d41e46de593d952a979f5530bb29d
SHA1 940dad43a87ac3f57db95176c82f27e98f6a5131
SHA512 f093a84792a4f0677d8e8b89ffdec3e267813ffe43a1f6032fc34a830399673a1549c6611921f21e399943de409d4091827e4dfbd6f7ae8c3ed5545cf2b0a2cd
MD5 SHA1 SHA512

Submit Download

memory/2664-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

Download

memory/2664-8-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/2664-2-0x0000000004F80000-0x000000000501C000-memory.dmp

Download

memory/2664-1-0x0000000000610000-0x000000000061A000-memory.dmp

Download

memory/2664-24-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/4132-25-0x00000000007B0000-0x00000000007BA000-memory.dmp

Download

memory/4132-26-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/4132-27-0x00000000056B0000-0x0000000005C54000-memory.dmp

Download

memory/4132-28-0x00000000051A0000-0x0000000005232000-memory.dmp

Download

memory/4132-30-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads