2d172d3a84faf1c5fc2a8b3b087d74450a8bddf3bd8c21dac61d1f84f23efa02

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe
Size 12KB
Sample240603-m7khqscc4x
SHA256 2d172d3a84faf1c5fc2a8b3b087d74450a8bddf3bd8c21dac61d1f84f23efa02
MD5 a1299921a906a1ce1502cd3fec750e70
SHA1 b9bc5624b9302198dd5170d49142c45d8babfa81
SHA512 17567fb430a728eab5bb9af354484d4d577ff6a9f995fa92a883d091294008338d3495e1ce904965331b911e799f07086f89315bd5a4ccfb1128b84b7554aa35
SSDEEP 384:/L7li/2zUq2DcEQvdhcJKLTp/NK9xaxb:zIM/Q9cxb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
4804	tmp6032.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4804	tmp6032.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1280	2304	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	86
PID 2304 wrote to memory of 1280	2304	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	86
PID 2304 wrote to memory of 1280	2304	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	86
PID 1280 wrote to memory of 3640	1280	vbc.exe	88
PID 1280 wrote to memory of 3640	1280	vbc.exe	88
PID 1280 wrote to memory of 3640	1280	vbc.exe	88
PID 2304 wrote to memory of 4804	2304	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	89
PID 2304 wrote to memory of 4804	2304	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	89
PID 2304 wrote to memory of 4804	2304	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jphsuwgw\jphsuwgw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61F6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4CF9BAA55DAD41FE92634281D22E6D89.TMP"
    3⤵
    PID:3640
- C:\Users\Admin\AppData\Local\Temp\tmp6032.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6032.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 8882461b44be62a6b4a33dd6a5ba5e6ed4b59bcfa47cf6d1e2c4f5af52bf4983
MD5 661cd275fd72be6d3e5d7ecbb667c91e
SHA1 d4911b3bd3d7b96975bd3da2f051e4b1753b251b
SHA512 3ad7f5006bbc8b888587b0239648397c7627cc538a3b10e93c4136b708f92367f94c5b2efcbe74c57a717dd2e9ca801c907fe20649f7058ad027fc42157fcf47
MD5 SHA1 SHA512

Submit Download

RES61F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES61F6.tmp
Size 1KB
SHA256 b8367f9b64873e265748114a75d5df85083332a7b1f7ff65d83391d60f6db19d
MD5 70cbb15f6a2410e47fd173b6b4db6d65
SHA1 6f0199512868b129e1efd9b9a59cc3ee24cf044a
SHA512 a5041c3503d53afbceac6db6a41674abbe93ec582d7f226e2ec10c0de24ad0bc6b2822460496bbc637e7ac46ce983b70eb7d0f767f68b76ef22d97bc090b6b91
MD5 SHA1 SHA512

Submit Download

jphsuwgw.0.vb

Path C:\Users\Admin\AppData\Local\Temp\jphsuwgw\jphsuwgw.0.vb
Size 2KB
SHA256 831f8ceb917b9c3b6d0600433b9d6d6834d030e2873b1c8d3ff1720949c2603b
MD5 140da8cc32c35aa30ff91c149e38afd1
SHA1 f63a570a347d6a9fda21d13b12bfa8bea2cf05eb
SHA512 1fbb3e4ee785bc2a289f4e7f27c25fe9db56ac00471608836631e7b2d0d579e6d3d3a337019c5008e729b0d19024459359b07765370c8e5534117c317068285e
MD5 SHA1 SHA512

Submit Download

jphsuwgw.cmdline

Path C:\Users\Admin\AppData\Local\Temp\jphsuwgw\jphsuwgw.cmdline
Size 273B
SHA256 aec891701cc0d600c5176fff136e562b04e3790b1c404586ab6a9dc27a642ede
MD5 03ad6d4a5f580caa76f5af5dcf192001
SHA1 37ae2b8355c4e3830a04d29b94f3b881382042d6
SHA512 87ee12f9ca0e86bac56bc692325deaf5d214830611d88788c88797265789f61a82a1ea72eba55690d950324d37db97ab26df0e59b6cc1672a78f400a70539feb
MD5 SHA1 SHA512

Submit Download

tmp6032.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6032.tmp.exe
Size 12KB
SHA256 3dd849de9ed261b554c412d70be3eafa859e21a68e88d50f058b9e9fa7cc5865
MD5 ee5c92b373085a7046c6c25fab86aa92
SHA1 6d79a349287081fbc9d782cbb48b64fb2765786a
SHA512 5530b801d107de6eb3b3af222f6999271c394bb14f0415898f5aaa714d0611a0eaa6c403ae619366ccbe7150bfbebf78747dec46cf2bb16fb6538fc1e7eb00f3
SSDEEP 384:QL7li/2z0q2DcEQvdfcJKLTp/NK9xaKl:OoMZQ9cKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc4CF9BAA55DAD41FE92634281D22E6D89.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4CF9BAA55DAD41FE92634281D22E6D89.TMP
Size 1KB
SHA256 8469f297ba65f24c806b8e1f177082201158f13bcc7bfac9ce2394c1bda262ba
MD5 f2b0fa8b0d1dec470ba31a4435e81ad5
SHA1 8d959e2f02e864337dacf712d3e5b276952a0a01
SHA512 73ab22f5ac1b335381227cd27578c1b69ed1be349aa79643ff247a729891c1c0529de734cc5150ebe0001c41408b06c1a21bcbee60a32e348684fbd3d3883dbd
MD5 SHA1 SHA512

Submit Download

memory/2304-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Download

memory/2304-8-0x0000000074BC0000-0x0000000075370000-memory.dmp

Download

memory/2304-2-0x00000000050F0000-0x000000000518C000-memory.dmp

Download

memory/2304-1-0x0000000000720000-0x000000000072A000-memory.dmp

Download

memory/2304-24-0x0000000074BC0000-0x0000000075370000-memory.dmp

Download

memory/4804-25-0x0000000000740000-0x000000000074A000-memory.dmp

Download

memory/4804-26-0x0000000074BC0000-0x0000000075370000-memory.dmp

Download

memory/4804-27-0x0000000005650000-0x0000000005BF4000-memory.dmp

Download

memory/4804-28-0x00000000050A0000-0x0000000005132000-memory.dmp

Download

memory/4804-30-0x0000000074BC0000-0x0000000075370000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads