257362d3335cb53d0e3b9055001952a946860e5aaa0989e8f37babfc1af9ad97

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe
Size 12KB
Sample240603-trrensdc63
SHA256 257362d3335cb53d0e3b9055001952a946860e5aaa0989e8f37babfc1af9ad97
MD5 d34659ad2755152a90f0395c8534c1e0
SHA1 0b5582a99b85eea7d921e0e0a75237f2ba77cfe0
SHA512 e02bdfc57c241f6ca664753a8fbcfe5d259e23f5e76d46af08dda2d2701b68901241725a7a0144b03bf05eee3826b9a6827ff18b98f725fbb735b17a54ce61bf
SSDEEP 384:nL7li/2z5q2DcEQvdhcJKLTp/NK9xaNb:LxM/Q9cNb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2412	tmp4845.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	tmp4845.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1092	2152	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe	82
PID 2152 wrote to memory of 1092	2152	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe	82
PID 2152 wrote to memory of 1092	2152	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe	82
PID 1092 wrote to memory of 5084	1092	vbc.exe	84
PID 1092 wrote to memory of 5084	1092	vbc.exe	84
PID 1092 wrote to memory of 5084	1092	vbc.exe	84
PID 2152 wrote to memory of 2412	2152	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe	87
PID 2152 wrote to memory of 2412	2152	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe	87
PID 2152 wrote to memory of 2412	2152	d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wd32jxg0\wd32jxg0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A57.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD146E069CEBA43CFB216445F25CBA03D.TMP"
    3⤵
    PID:5084
- C:\Users\Admin\AppData\Local\Temp\tmp4845.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4845.tmp.exe" C:\Users\Admin\AppData\Local\Temp\d34659ad2755152a90f0395c8534c1e0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 26833e90459c4580b15d84df1224b34d779abcde045f1fd6c14382879111070e
MD5 4b215f4feba3705e9405697ca014baef
SHA1 8f0cc10ae1d95eab867a75d2b56d9b30d0137d8f
SHA512 bf5928475db9cf3f16c93c6891e01d7074a170ef7e48cf0603f5fba93598d6f65869e8173ca275a70fd5a2ce2505a49b8eb5bdab962619605c1505dcd6d32a97
MD5 SHA1 SHA512

Submit Download

RES4A57.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4A57.tmp
Size 1KB
SHA256 f9680c930cc84b89300ef4a1428c3bb14edf3492d62fba9b6edf6f5c783357d9
MD5 058d167ce926474cdf769b74bd594bdf
SHA1 0cc77d95292de0e21c727e09998ecc6a0fc1cace
SHA512 7352e928f060cb37fb1d9ba11b9badf7a2949fb7b82d68342becb47cc5b618cc55f65ef779f4c09256a0d01143f20eed2d2c08e5a8e52b79dbbc670704c7cd6e
MD5 SHA1 SHA512

Submit Download

tmp4845.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4845.tmp.exe
Size 12KB
SHA256 15d81abfb8fe796f0b3d07dfa6aac6942c2f74799f03f66aa57d3b133c1fadd7
MD5 cee7241a301a801fd52aa95cc231a0bc
SHA1 228b75c67ba6b5b888dfdeacfba4481d99eed627
SHA512 ca5f10b54da7735adca9b618eeba92d29ea4dc97b5d4e31a0ef59621354853332fbf926743b164e79b985289a1a05dacc58f9947b7d7ff4772b0dc51ff4e38e7
SSDEEP 384:FL7li/2zsKq2DcEQvdfcJKLTp/NK9xaTY/:FgOMZQ9cM/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcD146E069CEBA43CFB216445F25CBA03D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD146E069CEBA43CFB216445F25CBA03D.TMP
Size 1KB
SHA256 ec338bc5e5380c1a2284af8c85b259d61e753170588823a5bd27478f1d8865c3
MD5 ca573e5b395f943756b6840cb08beb69
SHA1 92cd61bd8dc7af12a2a1d18b8dec938c9aea6dad
SHA512 f54b2d2c37f621655c4e884a20e281203073c4d8bd4459523275c33e84ef860b64ab885a1297438c02f9083a11a5a940c33f2db6351a9b222d6671fd31eee446
MD5 SHA1 SHA512

Submit Download

wd32jxg0.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wd32jxg0\wd32jxg0.0.vb
Size 2KB
SHA256 26c60bffcfa069721089f41a08be0ed869e544e68ce3fac625139128023cadc9
MD5 06db6c094be9241427eaa19ae1767077
SHA1 ffa7d6765d7df2bc06b695789ad16b86ec159be0
SHA512 80798aaeb55af2991918e500316869de1b9a63f9a8b052b68ddad54df292176f528a12c081e9ebd45644b4dda1138264d83104bf3a92f1fb532ffea5ab14953b
MD5 SHA1 SHA512

Submit Download

wd32jxg0.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wd32jxg0\wd32jxg0.cmdline
Size 273B
SHA256 b6ae4f7f4c37794ce53bb6b5e071ca325f2efc7d7fc94ffcf675002f9f84f7e6
MD5 111b599fa5d3c9f064a94e6abcb407b7
SHA1 21e2f3998a84d28cdaef4cdb1ba3131da2476a94
SHA512 771120b1e649d27aae5ac0b9a9740516adc1d7bbadcece4a77ac57b2980bd05ed40e1d3b9084617b0f6868831791f93bdccd7e5e9822e1a0614927890052974e
MD5 SHA1 SHA512

Submit Download

memory/2152-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

Download

memory/2152-8-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/2152-2-0x0000000004CA0000-0x0000000004D3C000-memory.dmp

Download

memory/2152-1-0x00000000002C0000-0x00000000002CA000-memory.dmp

Download

memory/2152-25-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/2412-24-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

memory/2412-26-0x00000000002A0000-0x00000000002AA000-memory.dmp

Download

memory/2412-27-0x0000000005230000-0x00000000057D4000-memory.dmp

Download

memory/2412-28-0x0000000004C80000-0x0000000004D12000-memory.dmp

Download

memory/2412-30-0x0000000074D30000-0x00000000754E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads