Analysis
- max time kernel
153s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe
- Size 88KB
- Sample240603-e82veabf5z
- SHA256 ee117623d309bea050333edaa1b873c84ff1b91eb6b15894c89303f0ff90382c
- MD5 9bcd3fb70736b5a773c62791860ce490
- SHA1 a77557887b779f9e4eadf35b827d1f7fc01b1d19
- SHA512 5ee617d8cc3313e522468d6e6e3ff7309ba1ec43d70706833ba5b1d82a062116b442e538bba3860c7a0c7c552572bfdce3b672379a0f73a8a38101bc6a9bc1ee
- SSDEEP 1536:zIKrFH+kKd/EsUzUVACD1LGLULKLdLaL7gW8ENVk4LINa:z5+D/EsUAtNVKU
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kiaxaaz.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 2552 kiaxaaz.exe - Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /h" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /N" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /v" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /d" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /B" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /y" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /e" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /c" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /X" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /t" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /A" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /x" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /l" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /z" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /Z" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /o" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /F" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /V" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /T" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /Q" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /i" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /r" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /O" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /f" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /W" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /s" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /G" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /H" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /J" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /b" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /I" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /D" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /Y" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /q" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /j" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /k" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /S" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /U" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /a" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /u" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /m" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /w" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /L" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /n" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /p" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /C" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /E" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /P" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /K" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /M" kiaxaaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiaxaaz = "C:\\Users\\Admin\\kiaxaaz.exe /g" kiaxaaz.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe 2552 kiaxaaz.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2104 9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe 2552 kiaxaaz.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2552 2104 9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe 90 PID 2104 wrote to memory of 2552 2104 9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe 90 PID 2104 wrote to memory of 2552 2104 9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9bcd3fb70736b5a773c62791860ce490_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\kiaxaaz.exe"C:\Users\Admin\kiaxaaz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4324 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:3972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\kiaxaaz.exe
- Size 88KB
- SHA256 950e028763d648ca217c64b77c5a6f05399597f6ae08dba683cf37fe3982977e
- MD5 1407c7873ade818d7e3bfb5412dd1fda
- SHA1 c10bb4790d260eb2cf063df5acfc0ffc40644cb5
- SHA512 03261b4b6880c5db25bc4d38eca9ed13ad25064f89db04b8c3774365a59e476edd4c95f3eabc5fe6b399ca6dc662c14d6c93df691f0ca93c3549e2e8594a4443
- SSDEEP 1536:jcn3sFH+6Kd/EsUzUVACD1LGLULKLdLaL7gW8ENVk4Lw9a:Q3s5+J/EsUAtNVSk
- MD5 SHA1 SHA512 SSDEEP