Analysis
-
max time kernel
2s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 11:44
Behavioral task
behavioral1
Sample
549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
549e0151d98fb8cf326ac692746ca8b0
-
SHA1
71655e27335ac9a72fd14f93106cc7495edd391b
-
SHA256
8bf1e71d289f6a7ca14da12774f18c6b1fa1afae51cf3e885cfc7dc60bb0eda9
-
SHA512
326c3b2ea4752dff1d4ff0d0a2a2ef90ca963753bc8093112172004f7f1e19f0fdbfda2a55e7914d0001e48ecd71a6240cec7e16758b1f6c1d53707f57b4ac37
-
SSDEEP
1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURA:JznH976dUCnuniDM
Malware Config
Extracted
urelas
112.175.88.207
112.175.88.208
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
huter.exepid process 2920 huter.exe -
Processes:
resource yara_rule behavioral2/memory/3048-0-0x0000000000400000-0x0000000000431000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\huter.exe upx behavioral2/memory/3048-17-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/2920-14-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/2920-20-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/2920-22-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/2920-28-0x0000000000400000-0x0000000000431000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exedescription pid process target process PID 3048 wrote to memory of 2920 3048 549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe huter.exe PID 3048 wrote to memory of 2920 3048 549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe huter.exe PID 3048 wrote to memory of 2920 3048 549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe huter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\549e0151d98fb8cf326ac692746ca8b0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD5a01dba4c45102fc15292fd5591166536
SHA1d96191c30e0f09439d8547f4ededbf6726ccd54b
SHA256cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904
SHA512277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32
-
C:\Users\Admin\AppData\Local\Temp\huter.exeFilesize
83KB
MD5549e0151d98fb8cf326ac692746ca8b0
SHA171655e27335ac9a72fd14f93106cc7495edd391b
SHA2568bf1e71d289f6a7ca14da12774f18c6b1fa1afae51cf3e885cfc7dc60bb0eda9
SHA512326c3b2ea4752dff1d4ff0d0a2a2ef90ca963753bc8093112172004f7f1e19f0fdbfda2a55e7914d0001e48ecd71a6240cec7e16758b1f6c1d53707f57b4ac37
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
304B
MD5436c5881b0a12fe8dda151c4c4565171
SHA1c73aeb348f7b2cf111de28c3fd16a15bec6069ca
SHA256ac606812ab95a593494e7d83432008f022acfe47b1168869dc09307d26672236
SHA51254d6ab3d0b21028660f994d1ba0e31cc485aa0066a94338633a17277ed18b6df8e1329534a9fca7d0785600a98b1c7c7d47d03de430a12035c318fb656a43628
-
memory/2920-14-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2920-20-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2920-22-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2920-28-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3048-0-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3048-17-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB