d40ba155e236f570cc23a11a9afa95ecbfdf1aa52b65c213dd8242f76ec0caef

Analysis

max time kernel
134s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe
Size

48KB
MD5

6e41f8ddb4d7daff19eda6523e97beb0
SHA1

44b2a710579f7e55739f8be164fdecfd06e0ab21
SHA256

d40ba155e236f570cc23a11a9afa95ecbfdf1aa52b65c213dd8242f76ec0caef
SHA512

3cbaf3ac936bbbad1bbe8f1bad371a51d32bada01a8370b9f9928b77bf9caeb148fcba115edf1321629d79d24d69e34720d200d0d5d91dc594c24e8a070f7135
SSDEEP

768:l2EMQWlqBxRlHzZN2zJo3LeivGnCoPToFr1tptjFhaO:0lqBxRlHzZN2zSPvDoPTojtptjzz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	laccm.exe

Executes dropped EXE 1 IoCs

pid	Process
4960	laccm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4960	4572	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe	82
PID 4572 wrote to memory of 4960	4572	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe	82
PID 4572 wrote to memory of 4960	4572	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\laccm.exe
  "C:\Users\Admin\AppData\Local\Temp\laccm.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\grias.exe

Filesize
60KB

MD5
9d3dabc7d607ca9737a29b3a85d2620c

SHA1
c9ed744eaf3321fef7cd578b7a7ca7f9c33cfb87

SHA256
a619860c2d48953f1a027a63b1c7fa2811f2811eb2dc3b4dac59cd9afa36d01e

SHA512
fa6231927e37d6da438ba0a18be416012e99ff0ce1f566d140971347d4bf22fb0924e43c5f3da10dfd86a0bfa3ed994cb7e55db05bdcbe05da4e81eac09c4a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\laccm.exe

Filesize
48KB

MD5
69d78bc22e08cd9318a565c07ea1275d

SHA1
9b2e76299335d644dcece1bdd7835055bfe3b47c

SHA256
e73988c012c9704c6b78e2eaaf178155a2ff650e96a48d43524371d7e2bfb9fa

SHA512
30269bff65b46476d5552bfc7e175cb94dae13c54fd9755e50c0997f4286afad6a1c4ed0831d7bada65198a67179c6f2b433d2b760b115c59986b24ddaf450d6

Download Submit
memory/4572-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/4960-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download