e7c836209cf401a565cec3a4bd85224507cb26607006a7f110be6ea7332c81dd

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe
Size 73KB
Sample240604-be2qrsge48
SHA256 e7c836209cf401a565cec3a4bd85224507cb26607006a7f110be6ea7332c81dd
MD5 1aaa271ce0aeecad141d8f2a79de9990
SHA1 cb68a08ae85fb1d701a86c35afc3d24046179317
SHA512 1356c5b8da093a4d3223ea9d79ff08a442387d80af7c28179285a4eb3efaa79bafc756f3aa82fac569e18aee80372ebba2374232af6cb6cc7dbb6ec8d4c7b0a2
SSDEEP 768:ZrItKyw5WHXfQmjIiIk9ecAx7pP1EPU96MyXPdtldE9bIIIwjklIIIIGRRRR5:Zr3Z5IfQmv81x7pP1r3yXPdtnyjh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1148	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4420	smahost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\smahost.exe	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\smahost.exe	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\smahost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2692	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1148	2692	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe	81
PID 2692 wrote to memory of 1148	2692	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe	81
PID 2692 wrote to memory of 1148	2692	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe	81
PID 2692 wrote to memory of 736	2692	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe	88
PID 2692 wrote to memory of 736	2692	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe	88
PID 2692 wrote to memory of 736	2692	1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1148	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1aaa271ce0aeecad141d8f2a79de9990_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\smahost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1AAA27~1.EXE > nul
  2⤵
  PID:736

C:\Windows\Debug\smahost.exe
C:\Windows\Debug\smahost.exe
1⤵
- Executes dropped EXE
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smahost.exe

Path C:\Windows\debug\smahost.exe
Size 73KB
SHA256 8c17d55b03239173e9b25728fee37848cce320c91b15f9614bb5b11f4457152e
MD5 d7c49aeb437e8cfe355baa17f531d484
SHA1 ac7240367f52c6311407532d198484c381dc42bc
SHA512 7c96a7d76a7a5a02ea187435c3e896ba69d4719e6e71d59d4911388715cc93be81c1676889e7754abc265005a36a425bd99d9882defbdf5ffed95a3932de89d0
SSDEEP 768:ZrItKyw5WHXfQmjIiIk9ecAx7pP1EPU96MyXPdtldE9bIIIwjklIIIIGRRRRs:Zr3Z5IfQmv81x7pP1r3yXPdtnyjk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2692-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4420-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4420-6-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads