7c0dc78f3495e489d78f09fb07e51ab29ada9adf2f5a9235538c10fbc201c762

Analysis

max time kernel
90s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe
Size 12KB
Sample240603-tb5mcsbe3y
SHA256 7c0dc78f3495e489d78f09fb07e51ab29ada9adf2f5a9235538c10fbc201c762
MD5 1ed45adf16d4a29f742e5bb69154aa30
SHA1 5fcd332ef089c400d2b8ad1190bd37bf5f7f1f45
SHA512 2c43139144f48a78e57a70e2fd18b4d79aedf10036aa2fa39024ba8001825245be513cf77fd17dd25d472e14670bc1631265478c2c97672bf32000e547bd5e23
SSDEEP 384:5L7li/2zjq2DcEQvdhcJKLTp/NK9xaR2:JXM/Q9cR2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
3268	tmp6BAB.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3268	tmp6BAB.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 3200	1172	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe	88
PID 1172 wrote to memory of 3200	1172	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe	88
PID 1172 wrote to memory of 3200	1172	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe	88
PID 3200 wrote to memory of 2088	3200	vbc.exe	90
PID 3200 wrote to memory of 2088	3200	vbc.exe	90
PID 3200 wrote to memory of 2088	3200	vbc.exe	90
PID 1172 wrote to memory of 3268	1172	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe	91
PID 1172 wrote to memory of 3268	1172	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe	91
PID 1172 wrote to memory of 3268	1172	1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r45czfqf\r45czfqf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CB4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc28D5BA3F72524CF1832C87E8CBBD923.TMP"
    3⤵
    PID:2088
- C:\Users\Admin\AppData\Local\Temp\tmp6BAB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6BAB.tmp.exe" C:\Users\Admin\AppData\Local\Temp\1ed45adf16d4a29f742e5bb69154aa30_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 7b6e0a57d006e04d3f044e5932f6d8301f6ca39a92e4d05e941dca89aca8eb8e
MD5 4e3c888040d9e4938adf4b5c73768a83
SHA1 56b50e053c1527f5cb0d13046582c13522147afa
SHA512 ae3d3c7cca3c7fc014eaa454c351f2ef340272d0a7b888cb7c18cd1a549033a54cd83fb38ed54cd0e2db9dabf561bb49e3642774d4e3ff16723d168dd89f90ef
MD5 SHA1 SHA512

Submit Download

RES6CB4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6CB4.tmp
Size 1KB
SHA256 9af663e5f8ba295da88b0a0fa9bba18490eaeca5ed72345a34393da1d40cefef
MD5 6b3cdbc1a51cf45fa9b9429c2765a641
SHA1 0ef82497828433565a73f9d45f0929e2ac131df8
SHA512 0c29196db43d878079373f8214fe59af66a8d42198e3adbeb5a472b603ace06ee9550cea847ef8aee566edac473d6cc19ee3644aa11f74323c2df79f21d14253
MD5 SHA1 SHA512

Submit Download

r45czfqf.0.vb

Path C:\Users\Admin\AppData\Local\Temp\r45czfqf\r45czfqf.0.vb
Size 2KB
SHA256 be816d9639966acd8cbd8f6c3a751bfa5386a4117abd4feb626408506f653ba4
MD5 37d46eb47345d4a552f60a135585fc8b
SHA1 1634ef5d3c0199abd71a6664b325e622f56b124b
SHA512 dfeea68ef5697f6523581216b832299a2c3d555c00c138564c323f1369f4c518e06f9d427729d49e581d02fbbfd728775a51c97722b48572f1c1f6c3205b50e6
MD5 SHA1 SHA512

Submit Download

r45czfqf.cmdline

Path C:\Users\Admin\AppData\Local\Temp\r45czfqf\r45czfqf.cmdline
Size 273B
SHA256 c5020bd95c6830a409c62596e0b67980a01ce847780a279bb463fadb14f08a0d
MD5 54bcca34e332c723229bb9def0487479
SHA1 297fd621f037afd076b9d3621ecae6e96fe6f001
SHA512 c14d4c7558f38d7e3fbe1c1de0f4537fc414965d557154566669768ad1bdc491a44acb240449389672196dad340a0f6d1c60f45fe52a63c798fa069348b979fd
MD5 SHA1 SHA512

Submit Download

tmp6BAB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6BAB.tmp.exe
Size 12KB
SHA256 aee60b1d6c7974b37d9e9d192f4927a1c19b88f35509c565e325691fb068ae01
MD5 50c1ebe0c47314425420eae89cc067e7
SHA1 ad12677109796935baf05f2262d00dc9eab43971
SHA512 c24745f58a8478c1fad885aef1dcfbc1f0196cb4e459a9a4556c02e271c3834ffa9a29ed964669ddc2f9dd0672d0745a8bb9f49f602cf007990cfa53bafecfa1
SSDEEP 384:mL7li/2zxq2DcEQvdfcJKLTp/NK9xaxZl:A5MZQ9cxZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc28D5BA3F72524CF1832C87E8CBBD923.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc28D5BA3F72524CF1832C87E8CBBD923.TMP
Size 1KB
SHA256 5cf2a6e105605a87c7ec7bb1aae4301575b677f5e43a305726cc431aa40d4c7a
MD5 b685ea107e406cf0a2addcb08bfc2906
SHA1 d80f164179bae2e919e98c303f3fd1c7b3411a3f
SHA512 9d70850d6b232b48739f0a91873dbbc7cfe048cfcc5c00115060268c0dd79b6812d406db140352b6c02ed570807954c472fd9d43f5f74a0d7af34eec27c1fec2
MD5 SHA1 SHA512

Submit Download

memory/1172-8-0x00000000746B0000-0x0000000074E60000-memory.dmp

Download

memory/1172-2-0x0000000005330000-0x00000000053CC000-memory.dmp

Download

memory/1172-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

Download

memory/1172-1-0x0000000000990000-0x000000000099A000-memory.dmp

Download

memory/1172-24-0x00000000746B0000-0x0000000074E60000-memory.dmp

Download

memory/3268-25-0x00000000003F0000-0x00000000003FA000-memory.dmp

Download

memory/3268-26-0x00000000746B0000-0x0000000074E60000-memory.dmp

Download

memory/3268-27-0x0000000005300000-0x00000000058A4000-memory.dmp

Download

memory/3268-28-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Download

memory/3268-30-0x00000000746B0000-0x0000000074E60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads