Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe
- Size 53KB
- Sample240530-rdwfcsba8z
- SHA256 7f802c2848872073d08870f3a727052b2cfafa63f04487069e151deb5c8afaef
- MD5 8d60cfce2976dc9a63e89c7ae1fd6000
- SHA1 986e2e4b3db4baf55563b3f91dd0a4e77e1729d0
- SHA512 ffa20cc7c2f5d48fa532879ef075373a91ccb08895336ffed580dcd8a92041fbd472af57750caa4003eb84f0f410ffe05e1d1a7b1663d66c824ff97e3e5ce0f3
- SSDEEP 1536:vNtg8r8QAk2Ns67Kp3StjEMjmLM3ztDJWZsXy4JzxPMk:kk226JJjmLM3zRJWZsXy4Jt
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wiueqoc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 2972 wiueqoc.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wiueqoc = "C:\\Users\\Admin\\wiueqoc.exe" wiueqoc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe 2972 wiueqoc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2476 8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe 2972 wiueqoc.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2972 2476 8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe 86 PID 2476 wrote to memory of 2972 2476 8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe 86 PID 2476 wrote to memory of 2972 2476 8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe 86 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81 PID 2972 wrote to memory of 2476 2972 wiueqoc.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8d60cfce2976dc9a63e89c7ae1fd6000_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\wiueqoc.exe"C:\Users\Admin\wiueqoc.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\wiueqoc.exe
- Size 53KB
- SHA256 cd4576f487362da1522453602d8d1071a67e2bd01d3dc68bb1920bc9cf8c50fd
- MD5 d72fd8bc7dd3885e8d69485f3190736d
- SHA1 e32870bb1d400181b058da6e948dc3684514a1d2
- SHA512 aa65ab6a7a528ac79aa86da725283d7682271525451329452671b363deb144ccf9b1a7fea1508ab6338b7265f6c1464e2c0ad8af6e9b7bb014dd914c605fc12d
- SSDEEP 1536:vNMg8r8QXnTU27Kp3StjEMjmLM3ztDJWZsXy4JzxPM0:8nTbJJjmLM3zRJWZsXy4J9
- MD5 SHA1 SHA512 SSDEEP