Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 03:59

General

  • Target

    9acbc355fcfb3f54b366848b01560700_NeikiAnalytics.exe

  • Size

    96KB

  • MD5

    9acbc355fcfb3f54b366848b01560700

  • SHA1

    8fb8a5a7e306683010e1477773f07ccd2906423c

  • SHA256

    9c85f03a5c61e4cfa7a02928ea32f2b2d3c62b8755d908d456268a89d454c760

  • SHA512

    5cb06b6172c02fe0fdce47b9b743e36d33f62ddfbba7d82b6bbb7e797545de5d093e1cf6b155d4861c559a5c4d95b630f70f1aa390e7e722c3ae76a13be89a63

  • SSDEEP

    768:eX4JA5vnURLQ/JD60XDeVtA5YwmHwWW2icNe78ljNZQcycU:eBvIQ/JDHKa5EJWceYljNZQyU

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9acbc355fcfb3f54b366848b01560700_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9acbc355fcfb3f54b366848b01560700_NeikiAnalytics.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Users\Admin\deimiik.exe
      "C:\Users\Admin\deimiik.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4980
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\deimiik.exe

      Filesize

      96KB

      MD5

      ac416403de61b43b0a808ad7d0e8c138

      SHA1

      b5b7bc4a499f296d930f499ad20074edabf0551a

      SHA256

      01022158f1bc5748e9c81c99d34377a15bf0fee09397522c9558d1b248c76908

      SHA512

      c2a9405fff76d19dfcb94dd07baa5913769a049877125288ab6316c9349576db7ae154e0dd7f21ee4a4f2aba8478f58925090aa4bcb568eed68f136d5ca74853

    • memory/3364-0-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/3364-19-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/4980-22-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/4980-26-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB