Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe
-
Size
41KB
-
MD5
3a6c12fd9277061790265b57ab2a7220
-
SHA1
66882d0daeacdcd044fe205bcbb8878352437b64
-
SHA256
fde4307a86fb4eb3d7767119879c4a29586c52c15f31fd20ef7f13cde7a52c7c
-
SHA512
c949f7f31dda57cb8aa311b62c826c3325e1519f33cb84b6688a99d03524acf77bc190adfdaee0d1dd1441c3e41ab5169426168a1c508e50a2b174956f84f23d
-
SSDEEP
768:MApQr0ovdFJI34eGxusOy9Rp1pLeAxoeC48PqK1c:MAaDJlMsh7pWezH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 2184 sal.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\sal.exe 3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2184 1808 3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe 83 PID 1808 wrote to memory of 2184 1808 3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe 83 PID 1808 wrote to memory of 2184 1808 3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a6c12fd9277061790265b57ab2a7220_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\windows\SysWOW64\sal.exe"C:\windows\system32\sal.exe"2⤵
- Executes dropped EXE
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5f961142c934729fe3a78368b5a4ea78b
SHA1b14186942b4d42883af0d78899260a2260ba47c5
SHA2561dbd0daf97470db46952338bf7d79274d0db54967de2966ed993dab3b1727b87
SHA512258ba5b86a11ff9ef00c2d1de083fb610fae6b3ce54770f93191f2f4078c7ce750535017cc9506da030c6be04b917c05bafd6461046ee3c4650d3c6f450e599b