c235a5577336ade8de1fed549eadbb46533c5c20d9ac627391fe805f106c1a9a

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe
Size 12KB
Sample240603-p7wbcagf64
SHA256 c235a5577336ade8de1fed549eadbb46533c5c20d9ac627391fe805f106c1a9a
MD5 a43fcd31cc238453e8426e6ba17d5e70
SHA1 4f3e547568895f3a7f72fdb452f462b7bb5f423a
SHA512 3387dfb4a23e228facd1462a1e24b96a894443a028bbcc07df28ceef0fd3aaf2634ebb780dba135aa028e62dfe62fddb687a83a6a305e4a7c46e72494bc26c54
SSDEEP 384:KL7li/2zTq2DcEQvdQcJKLTp/NK9xaRu:UfMCQ9cRu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2708	tmp50E0.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	tmp50E0.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1948	1720	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe	87
PID 1720 wrote to memory of 1948	1720	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe	87
PID 1720 wrote to memory of 1948	1720	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe	87
PID 1948 wrote to memory of 4460	1948	vbc.exe	89
PID 1948 wrote to memory of 4460	1948	vbc.exe	89
PID 1948 wrote to memory of 4460	1948	vbc.exe	89
PID 1720 wrote to memory of 2708	1720	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe	90
PID 1720 wrote to memory of 2708	1720	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe	90
PID 1720 wrote to memory of 2708	1720	a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\occ5l33x\occ5l33x.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5302.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDFCFAE3FD9A74A62851539F1BAE94054.TMP"
    3⤵
    PID:4460
- C:\Users\Admin\AppData\Local\Temp\tmp50E0.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp50E0.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a43fcd31cc238453e8426e6ba17d5e70_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 ece7d7b7aabcfce7b353df45a792d8660c973c36e32b9337b4baecc4ced33784
MD5 cb9fb49395f8f4153d804005077dc8c5
SHA1 c600f38927ec576a604eb92a79ef1382c5fe4667
SHA512 90701c663f54a9e85b3888e7e6a555a70532b177b868175ef20970600d1286a0aa6b7ec1fc8ddb9e453d0a6ca0dca966fa80b4ce0862c6ea758705097f2cbcd6
MD5 SHA1 SHA512

Submit Download

RES5302.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5302.tmp
Size 1KB
SHA256 a84e216d1fd444a81852e547a478498a37f88a52c5ccd3e46645987d37a5d315
MD5 9050efaf18e4063af3f9cad41069c308
SHA1 c75a623f97021963e38580e840351b2c3273dbb3
SHA512 247ed14a5a12eeb0d3b0821854f9932584dbc88185e337a4ee72b54ad87ef834ac32cb9af965a2ea169c347664dd9c96c5bd09da5c23bab5602ec1b584322f15
MD5 SHA1 SHA512

Submit Download

occ5l33x.0.vb

Path C:\Users\Admin\AppData\Local\Temp\occ5l33x\occ5l33x.0.vb
Size 2KB
SHA256 993ecd32dc9ae43011ed16fe6c066aca6460934f4941e176ac7abebefc4de5e8
MD5 e9e452dac05288a03b4d825bd8358b3b
SHA1 fb02036de7051bb8991541eac6a8a9534f13992a
SHA512 7da9684bfc40da5b367be86fc2de1433b3a3206f6348961686f3d465c67efacc20271a66ae8f3d99909ffedb46623f58b1ac89b65c27d56c4bc97212dac355cb
MD5 SHA1 SHA512

Submit Download

occ5l33x.cmdline

Path C:\Users\Admin\AppData\Local\Temp\occ5l33x\occ5l33x.cmdline
Size 273B
SHA256 3865cf7c8c947dcea0e213d01de46c1cce0fcdbf60167b0cd82d09f59902eb3d
MD5 47094d8fa8311313799a6ed209b319a4
SHA1 af3d838f965c1ee09da45d2e52f9defb5668a2c2
SHA512 e621b7a8df74d760138bc202ba92cf220a51def0cfbe7ec3a7cbf7273389748f9eaf36c479487a2f678c08f796bbf91538db6c6feb03ec46a42cd64c62f3fc69
MD5 SHA1 SHA512

Submit Download

tmp50E0.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp50E0.tmp.exe
Size 12KB
SHA256 4771ed637b73d93d971bfbce0dadc5ad867ed60f1f22b617ab666e5fee871634
MD5 cd8296a4fe457e8f3129856a0bb078b3
SHA1 bcdf4eafa38bb01bd712adf3170f959ed4e31632
SHA512 3cfa4c7ea097d5166bb34dab1d6f4f13775f87279772115a2eeedbecf4946b7cf63a8440dd10482f7d7b3dc3e00b68e1823ba615ec063feb087f3f3763c25f0a
SSDEEP 384:dL7li/2zEq2DcEQvdfcJKLTp/NK9xahg:N4MZQ9chg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcDFCFAE3FD9A74A62851539F1BAE94054.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDFCFAE3FD9A74A62851539F1BAE94054.TMP
Size 1KB
SHA256 93c0e683369da5d7a850848fe2af19c058d4f940cc36f7b1ed2c099ea3ea174d
MD5 7aaf3125a30b95d7258ed4d159e7cd71
SHA1 9c96a5702973473e313b3a619d6cfd50f165da04
SHA512 a607cdade50de83846de7928ccb730c977cbd49c09b110ad083a6297110e4fd3baa6f6d10272394e88bb543fdd552f9b9097b65a05c93fc6fa04dd799606e85b
MD5 SHA1 SHA512

Submit Download

memory/1720-0-0x000000007532E000-0x000000007532F000-memory.dmp

Download

memory/1720-8-0x0000000075320000-0x0000000075AD0000-memory.dmp

Download

memory/1720-2-0x0000000005790000-0x000000000582C000-memory.dmp

Download

memory/1720-1-0x0000000000E90000-0x0000000000E9A000-memory.dmp

Download

memory/1720-24-0x0000000075320000-0x0000000075AD0000-memory.dmp

Download

memory/2708-25-0x0000000075320000-0x0000000075AD0000-memory.dmp

Download

memory/2708-26-0x00000000004B0000-0x00000000004BA000-memory.dmp

Download

memory/2708-27-0x00000000053D0000-0x0000000005974000-memory.dmp

Download

memory/2708-28-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Download

memory/2708-30-0x0000000075320000-0x0000000075AD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads