c1884c59389620e398c738bd2c0bb44d7dd1deb327dddf690edf67432eec8bc1

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e217d9345c5d9267e2e793f618c7730_NeikiAnalytics.exe
Size

24KB
MD5

0e217d9345c5d9267e2e793f618c7730
SHA1

789241baef5d4d6b413f3093cb95c3807e627ed2
SHA256

c1884c59389620e398c738bd2c0bb44d7dd1deb327dddf690edf67432eec8bc1
SHA512

e23e41120ad2c46d62af002a5cdd8827531347dfea1a3c7ef31acda9fe2d1beae556073c311d3975f844e9c5f091e58dc7ff4edff4832da655173fa65e8a16dc
SSDEEP

768:CnpnIYh43Dc3GbWXLFaun5jfkcha1MbTY:qSq5jMca1MPY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	0e217d9345c5d9267e2e793f618c7730_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4936	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4936	2456	0e217d9345c5d9267e2e793f618c7730_NeikiAnalytics.exe	90
PID 2456 wrote to memory of 4936	2456	0e217d9345c5d9267e2e793f618c7730_NeikiAnalytics.exe	90
PID 2456 wrote to memory of 4936	2456	0e217d9345c5d9267e2e793f618c7730_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\0e217d9345c5d9267e2e793f618c7730_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e217d9345c5d9267e2e793f618c7730_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
24KB

MD5
8c3a94bcd0ab14ca7ede5485a266c170

SHA1
f5b2f14efddad4007fa3f43fb3d317729f31331a

SHA256
873cbc26aa07857129c80843c2a472179804160bcfc61c18afd22b2e8643debd

SHA512
2bfc1502fb57d59d776737f052cbc923c8bd90cf5987089846bf6743e480957f162641d1ba72006b4c12b190fda53b49e7a8f94ecadc52e27581f88ae3f3c950

Download Submit
memory/2456-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2456-1-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/2456-3-0x00000000027D0000-0x0000000002BD0000-memory.dmp

Filesize
4.0MB

Download
memory/2456-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4936-13-0x0000000002590000-0x0000000002990000-memory.dmp

Filesize
4.0MB

Download
memory/4936-12-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4936-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download