5e901bd8548a448228e51e0faabfb059508e116898f9683a3dc9301bdd0e9b0f

Analysis

max time kernel
133s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe
Size 12KB
Sample240603-nl8twach2w
SHA256 5e901bd8548a448228e51e0faabfb059508e116898f9683a3dc9301bdd0e9b0f
MD5 a1d4b2a5cdadd8bee8ff5c6f906acd60
SHA1 c99efce1b86b0b88121842e37dc81be8579bffa6
SHA512 f97fa0ef0e79de8d33acca6c967536540fb30427b9d04887330cdd059acfd6d7acdeec9679593d1d32ca4595a50ab8b8ae48bbc69b5ffd26d3f4ed20b4f22f24
SSDEEP 384:4L7li/2zWq2DcEQvdhcJKLTp/NK9xaha:G2M/Q9cha
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
3008	tmp377.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3008	tmp377.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2196	1296	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe	93
PID 1296 wrote to memory of 2196	1296	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe	93
PID 1296 wrote to memory of 2196	1296	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe	93
PID 2196 wrote to memory of 2328	2196	vbc.exe	96
PID 2196 wrote to memory of 2328	2196	vbc.exe	96
PID 2196 wrote to memory of 2328	2196	vbc.exe	96
PID 1296 wrote to memory of 3008	1296	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe	97
PID 1296 wrote to memory of 3008	1296	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe	97
PID 1296 wrote to memory of 3008	1296	a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe	97

C:\Users\Admin\AppData\Local\Temp\a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ot0loajf\ot0loajf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES579.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D64A32BFDB14620B48E6062C6297C.TMP"
    3⤵
    PID:2328
- C:\Users\Admin\AppData\Local\Temp\tmp377.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp377.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a1d4b2a5cdadd8bee8ff5c6f906acd60_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3404,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 c28c0c80bb6e155f5e3549566b0eadb04895c603dbdca4b559f07bc65cf08f78
MD5 3ba3a829ca9c650056f7f7d82d3e5d55
SHA1 6492fea5e7b0bed5f75d6b2f4d8e855908065b9b
SHA512 2fb65c6ea8fb2ed9b1bfe4e22fdb5855a7f767ee2b45e9b80032d10de2e911cfcddf9efc5a69cedb8e52c684d78e72adf4664115e5873cd78ec5dc23f8b54349
MD5 SHA1 SHA512

Submit Download

RES579.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES579.tmp
Size 1KB
SHA256 6dedca8dee10a5bd8b65a75a1aa769810704e7a2e40907802e96957170e7f9d1
MD5 7768165d3aa3ae7c60aba015eed75255
SHA1 68edf5eaddb35e3d057c53f494b89453a830fa45
SHA512 6bf433ccedf5d02cbd11fcf41f623311c13738cff9ad28941f7eacbd6e387bef86445f3714fc37cebb12c6a91cd68bd2192a8ce80fde5278e57dae9ccf0fb8d9
MD5 SHA1 SHA512

Submit Download

ot0loajf.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ot0loajf\ot0loajf.0.vb
Size 2KB
SHA256 ae54055600c2e1ae9bc0eaa9de7fbc114eebbdc0d53b3124286cccdea71b0b32
MD5 bcd9b3785ee63ba8db9d16c493dbebec
SHA1 5a35a217ee539adca0af7e9be2f2e5144d4debfe
SHA512 5b8105ac52f49d67a067081654d7953ce7a86bcb88043af874e7099a66de326f9469c6c530171e00b539d0487c822726ade1b01de8f4e01a33bc50eeaebee3f1
MD5 SHA1 SHA512

Submit Download

ot0loajf.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ot0loajf\ot0loajf.cmdline
Size 272B
SHA256 f8812e98a2d6a92b77e0b271e10c21df652314513b93a773998b658b003646e5
MD5 ae4f76f5440e8db5887b3295ad8bf7f2
SHA1 09f199b16e435fb5ff72bd2255e9eb4e2294e953
SHA512 ab6b47f2673f0ac2c0b1a0f0220e95d0bf273f4b8baa557eef20ae4942350ce0dafb08242efade545b6c865387eab9bb78420324f843f7a4f5a520fb7c388c06
MD5 SHA1 SHA512

Submit Download

tmp377.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp377.tmp.exe
Size 12KB
SHA256 f86b2b7ba19e1bb760e10343a8b6df88fad9abca815baf1c279d2f94cf283ac3
MD5 1f898ff8dbdaa6e0ecdc99023b97e66d
SHA1 1fb78f56333bee03b1a7ebc7974f57f5d945d137
SHA512 2abaa292470aef152f5b4784806e67b2fc7673653e34e94ad17211ce18f147f58bcd3e69263a1d08cd7170eb606359d1f0b1f460070e29769004706f2aa8c76f
SSDEEP 384:QL7li/2zjq2DcEBvdfcJKLTp/NK9xa/1:O/DZQ9c/1
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc3D64A32BFDB14620B48E6062C6297C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3D64A32BFDB14620B48E6062C6297C.TMP
Size 1KB
SHA256 cf78879b5e4e98cd44e726c5ffac7066c4877b2a34311b5ce63bbcdefecd909d
MD5 7b06bed5d43552385215402f70b0f766
SHA1 fb6b2cde7581549f63443ca1faaac460ff4670d8
SHA512 c40adc65279e8b4a548e47202f1cc1f668e12805ad6b041b53ee43fe35bef61d8364cfebb7e85571e8900eb7480701b5e2282024ae509fa200ee4d74e2443fe8
MD5 SHA1 SHA512

Submit Download

memory/1296-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Download

memory/1296-8-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

memory/1296-2-0x0000000005630000-0x00000000056CC000-memory.dmp

Download

memory/1296-1-0x0000000000C50000-0x0000000000C5A000-memory.dmp

Download

memory/1296-24-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

memory/3008-25-0x0000000000620000-0x000000000062A000-memory.dmp

Download

memory/3008-26-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

memory/3008-27-0x0000000005550000-0x0000000005AF4000-memory.dmp

Download

memory/3008-28-0x0000000004FA0000-0x0000000005032000-memory.dmp

Download

memory/3008-30-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads