Analysis
-
max time kernel
100s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
03/06/2024, 20:48
General
-
Target
00a85405c5dac086f44c019a13a4dc60_NeikiAnalytics.exe
-
Size
409KB
-
MD5
00a85405c5dac086f44c019a13a4dc60
-
SHA1
af35cce9252fe968b785f340fe0438a957a5eff0
-
SHA256
2d77ec342bc62fe11dcc79d0046d18a0476ae76679f444bf65e01ca381694fed
-
SHA512
538bf3578d96b8126d743dcc06c6ce6abf1669c8bc57b02a68eae82c6b458f3d43ce2332923bbd8f6af8e4f76b9af99a8bc5768f69de8850d80fdcd77835ac90
-
SSDEEP
12288:GrWcDkpFBK4TuxGzRrf1u+zV0+wqoKRx8y:GrWcDkpm4T9BzV0+vL8y
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a85405c5dac086f44c019a13a4dc60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00a85405c5dac086f44c019a13a4dc60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp" --pingC:\Users\Admin\AppData\Local\Temp\00a85405c5dac086f44c019a13a4dc60_NeikiAnalytics.exe E7F71C8F30924673CD02392A8B8F71E37B1DB4DD0CE280B6884EA215555F2076156708D2D6A43BADA92A76C15ADFB99E0CD98F598369DB49CA0D8182E60BCC462⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\00a85405c5dac086f44c019a13a4dc60_NeikiAnalytics.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD512e57ae08f64353b3c3b3d08681aaaf1
SHA136b6aca282497c65d41513b231d247b0187651f1
SHA25607498e905c47bfea983587265b88eb01bc6098978c375c71074b9469a99b4308
SHA512aba2748b1b5d26f52a93bbfabbd4760435b06d6c449631930e7db339c5317429f59cc24709515707cdda34956c73d30e60b83b81986873eb544b1040388748a8
-
Filesize
409KB
MD5659c4c83c12c162dfb5e7afc386f22ed
SHA12f5537e3da96b32aad76592e574667e999e22f97
SHA2568a631d5f336780c05c3c0baa57f96d94d7d5e7f539a591c1e40daa760c01d69c
SHA51200f6ae483a6222b26e6f3557cb62e7accf40b9a455ad94a93fbae31a03384d95126e0dd0ffff214fd9228da3123e4503a5114e5533fb24b02b5996908ca5c85c
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB