Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 00:10
Behavioral task
behavioral1
Sample
88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe
- Size 427KB
- Sample240603-af5clsdd53
- SHA256 266db7ab1bcc3419a7c72e2c022ee74eae1c2cca193461f39f46e4a5e5adb1d0
- MD5 88f848af4df9c026c21985d62c5f0720
- SHA1 2b77c9ca300edecda92a7de480afd52983648cad
- SHA512 a5db37c447a0019b95ebaa7db6b2122b0316047d010e44a5889d925115b29d726a3a4f4ecf10a0dea81732ec5536b0ebdb30e304ae9a9967726d4fa977825c63
- SSDEEP 6144:v2ja0W9vFWhZ4HYaWtsV6gNbncvlNFn9XGTWve/0OvCEg:v6a0W9vF2SLM0NAvlNFn8TWvecOvfg
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe - Deletes itself 1 IoCs
pid Process 1460 Sysceamuljva.exe - Executes dropped EXE 1 IoCs
pid Process 1460 Sysceamuljva.exe -
resource yara_rule behavioral2/memory/1504-0-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/files/0x000500000002296c-10.dat upx behavioral2/memory/1504-41-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/1460-42-0x0000000000400000-0x000000000046D000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe 1460 Sysceamuljva.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1460 1504 88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe 91 PID 1504 wrote to memory of 1460 1504 88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe 91 PID 1504 wrote to memory of 1460 1504 88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\88f848af4df9c026c21985d62c5f0720_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Sysceamuljva.exe"C:\Users\Admin\AppData\Local\Temp\Sysceamuljva.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Sysceamuljva.exe
- Size 427KB
- SHA256 7b39293fda7fb06e1e136c82d6d0e1baf4d12abec00da18fde06755c3b25949c
- MD5 72b986bc16cd7cc572612a58eff5a42e
- SHA1 8aa7356104e6a22a11c1aea04ee4ad7dda783daf
- SHA512 2775d093413e609fa946afdb64b1b4c4e7e26d4da73c19bec8e2a254f1eba11bc3bf5f0586b91f6da6493ca2e113abe6d22c4b9513abf28650c1a22c7f9887fa
- SSDEEP 6144:v2ja0W9vFWhZ4HYaWtsV6gNbncvlNFn9XGTWve/0OvCEH:v6a0W9vF2SLM0NAvlNFn8TWvecOvfH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cpath.ini
- Size 85B
- SHA256 babbc7a360a121a21c9689b7de055f14adc17765fb3cc60863c4ce79ce5447e8
- MD5 75e0b040f821006773c25b1eb2ca8304
- SHA1 5bcdeb2f417b57bfde363d14921cbccfb15aa17d
- SHA512 f81784d7a631953a2ff83767de65f0fe9e18a13bdc6b2dc84aa035eef4f53ae2c03eb88661ac96bd7793ce7f4684582abb556344e5ede2fb347d670a62b11cb3
- MD5 SHA1 SHA512