3ce7ab9ae87490a8bc750160dfb15c9c8782e95df7ebb00d45764a9da2eb9f67

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe
Size 12KB
Sample240529-pc5arsdh3y
SHA256 3ce7ab9ae87490a8bc750160dfb15c9c8782e95df7ebb00d45764a9da2eb9f67
MD5 530fcd19b8191682b2bef25b05c2c650
SHA1 b0b23b10336b0db1379391943821ba36d1c3f1cd
SHA512 6112e70a70ac846af3e3f1f786b835e8b37fd77c68fde1e80293991407943b42cbe6ca4155be15a242e3b26b083929e0471ae2e305da9aad4fccc2145f4148f0
SSDEEP 384:DL7li/2z7q2DcEQvdQcJKLTp/NK9xa7k:HvMCQ9c7k
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
1660	tmp4D36.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1660	tmp4D36.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4764	212	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe	85
PID 212 wrote to memory of 4764	212	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe	85
PID 212 wrote to memory of 4764	212	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe	85
PID 4764 wrote to memory of 3408	4764	vbc.exe	87
PID 4764 wrote to memory of 3408	4764	vbc.exe	87
PID 4764 wrote to memory of 3408	4764	vbc.exe	87
PID 212 wrote to memory of 1660	212	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe	88
PID 212 wrote to memory of 1660	212	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe	88
PID 212 wrote to memory of 1660	212	530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3p0wqknt\3p0wqknt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E8D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc91594A15641441DC80303A88FECBBADE.TMP"
    3⤵
    PID:3408
- C:\Users\Admin\AppData\Local\Temp\tmp4D36.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4D36.tmp.exe" C:\Users\Admin\AppData\Local\Temp\530fcd19b8191682b2bef25b05c2c650_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3p0wqknt.0.vb

Path C:\Users\Admin\AppData\Local\Temp\3p0wqknt\3p0wqknt.0.vb
Size 2KB
SHA256 4ece797c0b62e46795bd1630a75eca129dab9348a6156bea1cecfd33f43d5a83
MD5 099b3a7ea303642ffb9fb0defc538aca
SHA1 cae97fcb9b88b91c3aa583ed26fad39dceec6e12
SHA512 9f5c0d485fc533c9ae346dc2b37fca658615e0aaf6e0c0b2675b98a901f0055a33e14a27b9f76cc3aaaf460e74ff3f2958538cb860b2c56b73f8d8e7f3f964fc
MD5 SHA1 SHA512

Submit Download

3p0wqknt.cmdline

Path C:\Users\Admin\AppData\Local\Temp\3p0wqknt\3p0wqknt.cmdline
Size 273B
SHA256 938d14cdba774ae052567a73cd679015f8e50e8a4d3887d68d2766837f4dae2c
MD5 16c0e7da7f9133c5a6dcd5bbcdf58339
SHA1 7a824259bd9f5fcdf8f03521790460921e1a060d
SHA512 43d95f220c875c241f5ab7fdd58878e3d360e607551835eeedd966053cd32377b7f40fe66d309204b4e3950aeddae1cc04a9df2c500119eb4c50445d48689753
MD5 SHA1 SHA512

Submit Download

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 07fa46bf66eca5dd74bf38258eb8ab42d7c01375498c689f43fb18b8d6d8489a
MD5 53dcdc0a14c02f29a05c57323c2f2755
SHA1 3dccc5c93c7e6310866a33ae0d28b1198e70d687
SHA512 9f3129b8e995567ed66771e249affcf3242b0e81121d87adee4c5eb4da765d1bfd6ed6b5dda6004e4a35eaec61ead5d3007b95dad39658ca12a481a720d47334
MD5 SHA1 SHA512

Submit Download

RES4E8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4E8D.tmp
Size 1KB
SHA256 8e84735b406ca997053446aadf11d514e80db9261e4616d737112ae412ffb8a0
MD5 f68ee4e489858de7189707976f0dee52
SHA1 58dc853da323cf810a232184931d62ffefe3257c
SHA512 002b35df29de982a87ef140fcc42a0f713daf9f5aff25e922f4951fcc691a575b116fca1c5266c80aaf15fb0cf87d7adec1f341ed4b8941a6ba20a759bae83ac
MD5 SHA1 SHA512

Submit Download

tmp4D36.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4D36.tmp.exe
Size 12KB
SHA256 4cbd76097974fa58fca9138467e685887a759d9dc26a2618d6a1cfc515717ff1
MD5 1309fe3fa7d748fbc53d0bcb7d7dbb0b
SHA1 767020cef0136753d9bb25a1fb8335e638a4fc2c
SHA512 9cc65885c6a0d236257ea7a9eb88c6d583b627d89c0786a81a1794186f6e30300670b9c117f67233aa3692664b937e09f0fa75056057f5d2677da6a362e53f87
SSDEEP 384:4L7li/2z6q2DcEQvdfcJKLTp/NK9xaBv:GCMZQ9cBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc91594A15641441DC80303A88FECBBADE.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc91594A15641441DC80303A88FECBBADE.TMP
Size 1KB
SHA256 4dac15598df34e8fbbfdb7bb09d32015da98bde60bacc09dbf033231c60ea80a
MD5 b2e891b4041392b1248551b4417f8cb5
SHA1 75ba4f61620f5cac3d8f6423f5d901a2b8471e71
SHA512 387b1652e3dc614c78bcd2e17b01e4a425cc93221aab9602aaae4cb4c5f7f95c874b0d0914d840d0bad3121d863c9f9806c67594c952fac4f619f73f76e7befc
MD5 SHA1 SHA512

Submit Download

memory/212-8-0x0000000074BA0000-0x0000000075350000-memory.dmp

Download

memory/212-2-0x0000000005190000-0x000000000522C000-memory.dmp

Download

memory/212-1-0x00000000007F0000-0x00000000007FA000-memory.dmp

Download

memory/212-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

Download

memory/212-24-0x0000000074BA0000-0x0000000075350000-memory.dmp

Download

memory/1660-25-0x0000000000420000-0x000000000042A000-memory.dmp

Download

memory/1660-26-0x0000000074BA0000-0x0000000075350000-memory.dmp

Download

memory/1660-27-0x00000000052D0000-0x0000000005874000-memory.dmp

Download

memory/1660-28-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Download

memory/1660-30-0x0000000074BA0000-0x0000000075350000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads