Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe
- Size 53KB
- Sample240603-hff9safa7w
- SHA256 e27fb12235313f5fbc4885962952fdcd50077a267fc2efa1fc92b4c1547ed2ae
- MD5 9f0cf3dc8de579f728f817e2b7d1de40
- SHA1 7b84b09c4237d26d14eb1e7e70f81c6222277dab
- SHA512 413252657ebd116bbaea7c595e629ed810e10087cd4fdd1bde593d942f622372ce37e63eb72c35bcb5b845742edce16bb2855d536be7233cce2e97c46f997d1a
- SSDEEP 1536:vNWg8r8Qad2uK7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:fd2uKJJjmLM3zRJWZsXy4J9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neode.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 400 neode.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neode = "C:\\Users\\Admin\\neode.exe" neode.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe 400 neode.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3352 9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe 400 neode.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3352 wrote to memory of 400 3352 9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe 80 PID 3352 wrote to memory of 400 3352 9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe 80 PID 3352 wrote to memory of 400 3352 9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe 80 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79 PID 400 wrote to memory of 3352 400 neode.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f0cf3dc8de579f728f817e2b7d1de40_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\neode.exe"C:\Users\Admin\neode.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\neode.exe
- Size 53KB
- SHA256 1ace6c1bd53fe97be7e77ddd4088a16f01cc2438ea6f0af5636242a1fa94b07e
- MD5 fc52e51836e37dcf25ecb28fc68a7426
- SHA1 c4d9b1948d3f81e12144c5801ba3d772e80d5703
- SHA512 f447acdb96879e4b02a175dba25b1b7eb8dd92e5854fd251f99fb4145d562ff97ac3c24f27846a5449942da09c693914548fa0aea0de450b23aa3488e10749ad
- SSDEEP 1536:vNRg8r8QsAIG7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:gAIGJJjmLM3zRJWZsXy4Jd
- MD5 SHA1 SHA512 SSDEEP