1d25f31dfce99e86c6b39d75d18b6140baf13caab5145573ae3f55a41e90240b

Analysis

max time kernel
134s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe
Size

262KB
MD5

949cac1292cfabc3865f9d90ec42ce30
SHA1

c819fc0eea9455ede347b3a6ac8786cc2057d4b7
SHA256

1d25f31dfce99e86c6b39d75d18b6140baf13caab5145573ae3f55a41e90240b
SHA512

b16a7031baa2f8d335e356b56ea712c3f016336e3ea0fe95f0bebb6628aaa4945dc517252a87e1abff020e25c30238a1560aeef99f42a308409c9e399b5eff6a
SSDEEP

3072:O7BMvaWjzrLXQQJKgmSBAVpet2AgoQlMZj:saaWjz/gGKgmS+k2t2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4300	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\c61e0f7a\jusched.exe	949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe
File created	C:\Program Files (x86)\c61e0f7a\c61e0f7a	949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 4300	3080	949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe	96
PID 3080 wrote to memory of 4300	3080	949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe	96
PID 3080 wrote to memory of 4300	3080	949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe	96

C:\Users\Admin\AppData\Local\Temp\949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\949cac1292cfabc3865f9d90ec42ce30_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files (x86)\c61e0f7a\jusched.exe
  "C:\Program Files (x86)\c61e0f7a\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4280,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:8
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\c61e0f7a\c61e0f7a

Filesize
17B

MD5
2130fee70fc3f7c10d5279f96f98ad1e

SHA1
4307cef89171fa230048ea22546802198d888780

SHA256
3506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404

SHA512
67fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5

Download Submit
C:\Program Files (x86)\c61e0f7a\jusched.exe

Filesize
262KB

MD5
dd46be16f8b0b9ddec39503c7a588797

SHA1
d719cf88ec007b34d73010cfb33165f3fefe7988

SHA256
5ef9c57665aa95b5a22311308d682ac9e15b1e56dbb23bc6c51dbbb8e478fd24

SHA512
92bea9e04525b8f953c5cb635284642d1a2a1c7c2edb4fc5021033f00584c5c58e105996b7f182069bd0e81ae14897057ec58d2c37f1ac1f822837220a49e2fe

Download Submit
memory/3080-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3080-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4300-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download