7abfdb9b647f74e3714d8bd2dad5a1f0ae9356dfe3721b2e4a5e8dbd1cff22fd

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe
Size 12KB
Sample240607-a63xgaef7y
SHA256 7abfdb9b647f74e3714d8bd2dad5a1f0ae9356dfe3721b2e4a5e8dbd1cff22fd
MD5 29fb0f13e1b7c9ba6ce1d03b067ef7c0
SHA1 f661dcd93cbd8a0cde06e4200dec04a24d508a32
SHA512 befd7153c1a114760fec74147b83896cf5d3424b6afe41c963a36859bc104151785dac48b7305e683048c49d38b22c18a8e4bc406d846a0f003a743240c10c05
SSDEEP 384:HL7li/2zyJq2DcEQvdhcJKLTp/NK9xaqX:r0M/Q9cqX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2456	tmp42B7.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2456	tmp42B7.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 1920	436	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe	85
PID 436 wrote to memory of 1920	436	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe	85
PID 436 wrote to memory of 1920	436	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe	85
PID 1920 wrote to memory of 1520	1920	vbc.exe	89
PID 1920 wrote to memory of 1520	1920	vbc.exe	89
PID 1920 wrote to memory of 1520	1920	vbc.exe	89
PID 436 wrote to memory of 2456	436	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe	90
PID 436 wrote to memory of 2456	436	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe	90
PID 436 wrote to memory of 2456	436	29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fp32mgmi\fp32mgmi.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43B0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc799DC7FDFBD044EA919C3B266F7FDAA.TMP"
    3⤵
    PID:1520
- C:\Users\Admin\AppData\Local\Temp\tmp42B7.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp42B7.tmp.exe" C:\Users\Admin\AppData\Local\Temp\29fb0f13e1b7c9ba6ce1d03b067ef7c0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 200a871c53e804df02ada3ce7c69de712c390375e8e77301f00fb1e3cc14b322
MD5 7cc133e23921c4e52a11e15d66baa87b
SHA1 5f569b78f0022e2878d3ad0a67479c11dccf5359
SHA512 ae8230ac901b68177e1e375604594d5f0326a0813b1e103390fb6434aad71f8c251bbebfec00fce18abd9018ca8337e6353570911338741396de7792a687f46b
MD5 SHA1 SHA512

Submit Download

RES43B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES43B0.tmp
Size 1KB
SHA256 81adfca9dbb69d22b2e92130c11a60c8d1c3f992e2b312f956fd77a27038b4a1
MD5 47197e2f45a0cfd1271adb89e0399285
SHA1 8322b2c18f7f6340844cd1dd0db2e31759733607
SHA512 0046d7f01e1e89731fb6c1e1e8f745743068678bec5f550ee0abb8188eedabfc520b6e7f33d9c365dda633c969cf088705202b67ac8311b51a30f9234915263b
MD5 SHA1 SHA512

Submit Download

fp32mgmi.0.vb

Path C:\Users\Admin\AppData\Local\Temp\fp32mgmi\fp32mgmi.0.vb
Size 2KB
SHA256 b2456516e4bed32d3b2737a39da8c1faf1065d1321dd69701188f88e4d398c11
MD5 acf1f093f110cc9aed7f5fd8d53aea1f
SHA1 0bbf47691268b7318c87aa74dfa8eff187029ab8
SHA512 4129a158c66cef988b79647f5d45ca527c76c7095c5be0fd7a0d0e5234a97516d4ac695fe2fcef2f46ad8c5ae111d25800316d2b43b426ef8be0bac6ff6e4fd9
MD5 SHA1 SHA512

Submit Download

fp32mgmi.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fp32mgmi\fp32mgmi.cmdline
Size 273B
SHA256 3b5eff4c393cd6b225d3fcca460227ed298cb2813e3b51b8519f12e23d7abc35
MD5 4562750303d31b3ecfded1d5a650db18
SHA1 dd193b826cef10ee2b9149c62249bed5264683a2
SHA512 0306eadb950832594c6fd5994cc639c4e63a47cec5a8fe8aec65db8bdbe5d110ce05521d6e6c8c83538e9172ed9e182c1f3f6be8169ce6795dd12c4d7dbf510f
MD5 SHA1 SHA512

Submit Download

tmp42B7.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp42B7.tmp.exe
Size 12KB
SHA256 bad0a2c2fc30004ef72590927b875b5cf2491b9cf51fa156c45a4b3f0acbdf49
MD5 7dad86e8e815cc51d2f8a59844adc0eb
SHA1 7bb4105d8f688c618d799bced435f3d66ed2cc37
SHA512 da8c006b98f0a5fd53a01a021e8b8577ecce6e38fb4474a9ad16248c7165eeaa59d0fd65acdd77b5631666c636456f233c52f191924f44eaf63516b2ac6e8cff
SSDEEP 384:NL7li/2zg7q2DcEQvdfcJKLTp/NK9xash:dYMZQ9csh
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc799DC7FDFBD044EA919C3B266F7FDAA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc799DC7FDFBD044EA919C3B266F7FDAA.TMP
Size 1KB
SHA256 db838b3233e5fd651fb8ede4b8422f76f7afb723bb68ddd5ecdaf52dd183b0fb
MD5 39ec807135c304f8897ca7567d40b350
SHA1 e55fdb3c3c4ab4e3d5d221b3305d5c1de013c435
SHA512 733ba0b9d1eec0c5b6338d3f6008280ba15d147ffda530c8530aa5433242e405dad1ea2fdfc22684bff45516d18db15eef6acc0ef46a17519e82bd9bdaa1f5f4
MD5 SHA1 SHA512

Submit Download

memory/436-0-0x000000007504E000-0x000000007504F000-memory.dmp

Download

memory/436-8-0x0000000075040000-0x00000000757F0000-memory.dmp

Download

memory/436-2-0x0000000005140000-0x00000000051DC000-memory.dmp

Download

memory/436-1-0x0000000000710000-0x000000000071A000-memory.dmp

Download

memory/436-24-0x0000000075040000-0x00000000757F0000-memory.dmp

Download

memory/2456-25-0x0000000000630000-0x000000000063A000-memory.dmp

Download

memory/2456-26-0x0000000075040000-0x00000000757F0000-memory.dmp

Download

memory/2456-27-0x00000000055C0000-0x0000000005B64000-memory.dmp

Download

memory/2456-28-0x0000000005010000-0x00000000050A2000-memory.dmp

Download

memory/2456-30-0x0000000075040000-0x00000000757F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads