015a07881cc8375bc49971e744e8a6fedf91ff451aa083086a83233817d64c43

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe
Size 12KB
Sample240602-2bxkraac72
SHA256 015a07881cc8375bc49971e744e8a6fedf91ff451aa083086a83233817d64c43
MD5 764b6ffa1aaf1158c00c65b20c47ca10
SHA1 898acef46c939d47810da2699860b9da7bf5c983
SHA512 068a80308535412cb99b4dd17ed5e6e8bf9b94d06dc925ef5fb15a2465159e9d4cd7f26354278d2fa5a8d4eca9aa8e9e7a09e01edbcb3511323289d67312bbcd
SSDEEP 384:aL7li/2zyq2DcEQvdQcJKLTp/NK9xavO:EKMCQ9cvO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
3728	tmp4BFE.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	tmp4BFE.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4244	228	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe	86
PID 228 wrote to memory of 4244	228	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe	86
PID 228 wrote to memory of 4244	228	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe	86
PID 4244 wrote to memory of 5028	4244	vbc.exe	88
PID 4244 wrote to memory of 5028	4244	vbc.exe	88
PID 4244 wrote to memory of 5028	4244	vbc.exe	88
PID 228 wrote to memory of 3728	228	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe	89
PID 228 wrote to memory of 3728	228	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe	89
PID 228 wrote to memory of 3728	228	764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nbmgyz4e\nbmgyz4e.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E20.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCD858978FD7D4841BB28BFD7A861F4.TMP"
    3⤵
    PID:5028
- C:\Users\Admin\AppData\Local\Temp\tmp4BFE.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4BFE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\764b6ffa1aaf1158c00c65b20c47ca10_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 a6c35801b52a284b3ca1bb21bbd8194e3f06847b4758ada955adb24a8d29ed97
MD5 e166f6397c6cae7b1528be4f7d717978
SHA1 6b2fadc8121cce62a3806ca9a73c076e7ccf403e
SHA512 fbe7ead2dbaae481f7eed6e7937a0527e05ab25a7227a90f84ae0aaf686c9bc5aa67fa2ecdcca1a4a4d5781a7c4fb621cba7f47d490702e26af33906a85c0380
MD5 SHA1 SHA512

Submit Download

RES4E20.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4E20.tmp
Size 1KB
SHA256 a2f13eda4033db4eccf881883be1c7a8d1f4c159987f6dbf1b3d1330905f8b3e
MD5 f170330bff4cb1bc77f9a51cafdb348b
SHA1 2be2a1c263ca0084c315ccc027400bef5a7418b7
SHA512 2fe9ca6c3be5fa59c9b84e017db96bc9680417f2de03944add0e4913b78d20f371ee18dff68312b2ebc132d04e10c91c89375d90a1ede0ad712d934bb6807deb
MD5 SHA1 SHA512

Submit Download

nbmgyz4e.0.vb

Path C:\Users\Admin\AppData\Local\Temp\nbmgyz4e\nbmgyz4e.0.vb
Size 2KB
SHA256 2f84420de6817c061ce2a5ed5765b59041e229be2a77a71705057c492bf71dd1
MD5 ccbe9ef0c3eaee9f8a246ca051231e78
SHA1 bb6d792166ff88efa81ea8ea72a1a114ffb298fa
SHA512 8f720a10e4effd84f387d222b4bd13f880a0e26442c55fe44fe8b4a6679d1a9dde1913b1ac1b05b4d9b5f6f71da4424d3758d490d8dc46c9185c6201ebbf0ba1
MD5 SHA1 SHA512

Submit Download

nbmgyz4e.cmdline

Path C:\Users\Admin\AppData\Local\Temp\nbmgyz4e\nbmgyz4e.cmdline
Size 273B
SHA256 ce695615a5f4f87a58618e8839231c8f563aade5011a12435c0ffd832a9044e0
MD5 f415199deaa8fb15cb7b2aaf01bcab6c
SHA1 c94bd7bd7e9a1867d59fef0a21579afa6fba9e7b
SHA512 56b4113e0aa645c9a52b52b353aec2b3b1f42b0c591a3365715f29d889e64c90318bd23a368e5be9cc30f4b5e2e1fb1aabef230e0182c6ee121812f92b59bdd7
MD5 SHA1 SHA512

Submit Download

tmp4BFE.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4BFE.tmp.exe
Size 12KB
SHA256 93ac9e349b069bead36dca9074d08d03212382c05e9651df1889be4e26e4e705
MD5 0de5e680006e6e4b0225acdbe2d93ea0
SHA1 7d68cbc26e0606c38da432d912bbe6056cefdf8c
SHA512 19ce4ccf854a221efe03db2f37d306759f2ffaaaa73b07b3e647e53f2a0e5eaa047fbef55ac7854d2b6bdb3e001e481fd49876cb68bbbc568dc1e4e1f7d81676
SSDEEP 384:2L7li/2z0q2DcEQvdfcJKLTp/NK9xaVX:wAMZQ9cVX
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcCD858978FD7D4841BB28BFD7A861F4.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcCD858978FD7D4841BB28BFD7A861F4.TMP
Size 1KB
SHA256 129aad6c582f6bf6e5a5d6cce29c2f7aeb46640466667c7ea242fa426e243399
MD5 d0e6ac6813b2ab5e6fd433b7d205e19f
SHA1 e05ef9f3448b3b50d6e70c43fd3bf0ff84df7590
SHA512 44866dbaa325fe5e9137a03cef6341930a284b53df9f2c55b03c424412012edc6ef51553e368b23a6b0ce90790d141f7d1393bf612563ab2c590ace2ffa2f0cc
MD5 SHA1 SHA512

Submit Download

memory/228-0-0x000000007492E000-0x000000007492F000-memory.dmp

Download

memory/228-8-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/228-2-0x0000000005590000-0x000000000562C000-memory.dmp

Download

memory/228-1-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Download

memory/228-24-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/3728-25-0x0000000000650000-0x000000000065A000-memory.dmp

Download

memory/3728-26-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/3728-27-0x00000000054F0000-0x0000000005A94000-memory.dmp

Download

memory/3728-28-0x0000000004FE0000-0x0000000005072000-memory.dmp

Download

memory/3728-30-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads