Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe
- Size 145KB
- Sample240602-2eb38aad84
- SHA256 edb99c3f561d3db84ef735783189e2eef9863b13859f28b47ded44bd665e4cf8
- MD5 76df9109b1c19835bd17df9696329220
- SHA1 42544c707cbfbb4c8a7cec19149e37408cf58c31
- SHA512 1526b84e922b0750f4ee6db5d2818ef33dc732a572df496da9cd2238edd2d1aea2530c53c1f99a2adea4dee4410ac3e21e8083ce600aaff8015eea11cf56ada9
- SSDEEP 768:j/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLE6:jRsvcdcQjosnvnZ6LQ1EE6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.tripod.com
-
Port
21
-
Username
griptoloji
-
Password
741852
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 3740 jusched.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre-09\bin\jusched.exe 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Java\jre-09\bin\jusched.exe 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe File created C:\Program Files (x86)\Java\jre-09\bin\UF 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe 3740 jusched.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1772 wrote to memory of 3740 1772 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe 95 PID 1772 wrote to memory of 3740 1772 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe 95 PID 1772 wrote to memory of 3740 1772 76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\76df9109b1c19835bd17df9696329220_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:81⤵PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Java\jre-09\bin\jusched.exe
- Size 145KB
- SHA256 599568cfe9b978b609b4bdc02aae4b2244bbcceb10d586ce9719f1175460efc4
- MD5 c4ec1c8c46d98a9ed36e5788dde9605c
- SHA1 c95849e218002433cbe2ee755f02db376cf1237b
- SHA512 f25731010e86cff801463c309d90ccf0b2500667b4dac901491c4a1009e9246a3e4dcd5912b73b9496eb851f7d009a407488f73a533dcf86e92f8aa36c52561f
- SSDEEP 768:j/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLEY:jRsvcdcQjosnvnZ6LQ1EEY
- MD5 SHA1 SHA512 SSDEEP