3d3d56f07ed5f8f3f359f11d82f33edc708ef40a162a42f6592fa40bd031e365

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c6af732884a4b34c16f1426cff203a0_NeikiAnalytics.exe
Size

5KB
MD5

8c6af732884a4b34c16f1426cff203a0
SHA1

bce0fea3e7c282ddca054fe43ad94cad99cc5053
SHA256

3d3d56f07ed5f8f3f359f11d82f33edc708ef40a162a42f6592fa40bd031e365
SHA512

e83d69fb56c0f6bcd498e898f8e3fd408f1795f7db47f8ab2c04cd36cac872f73f07a1adac1d5677422a7539d0fc54699183c653518963c8b8c8532d422ca745
SSDEEP

48:q01xRAmcRB/G9OzR3mePcra1rsHB/VnC/RAxUl2CS70ALNx:FqhLzR2aceuHnnwR2Ul2ClAhx

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	8c6af732884a4b34c16f1426cff203a0_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
1040	winej.exe

Executes dropped EXE 1 IoCs

pid	Process
1040	winej.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1040	1124	8c6af732884a4b34c16f1426cff203a0_NeikiAnalytics.exe	90
PID 1124 wrote to memory of 1040	1124	8c6af732884a4b34c16f1426cff203a0_NeikiAnalytics.exe	90
PID 1124 wrote to memory of 1040	1124	8c6af732884a4b34c16f1426cff203a0_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\8c6af732884a4b34c16f1426cff203a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c6af732884a4b34c16f1426cff203a0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\winej.exe
  "C:\Users\Admin\AppData\Local\Temp\winej.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3416,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winej.exe

Filesize
5KB

MD5
e63cb42565ea1bd00fdfa165242e4c57

SHA1
522b488000b0e15adb574035f413cd3940f8e985

SHA256
7bb91bf52482f7f2e1e57b16aaa0c75ee8b4af89c70b24d46f7c3410459d4f82

SHA512
d15ec68406b3b1b5b42d59698f8da6757738f3b12f7c3a85f2c2cea68532b08e40c215e95fad958f57d957d1918c53914411888a881662c8a6b4bf2a134920ca

Download Submit