2223fd00f676b3c88db4061d4605d877644af186220c0fe4a0eb1875d8310285

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe
Size 12KB
Sample240608-se6s6acg2s
SHA256 2223fd00f676b3c88db4061d4605d877644af186220c0fe4a0eb1875d8310285
MD5 72f8d0a0bdddb921ff9fe7e366b9d250
SHA1 96540e093246c9f51661859afe2386f562f0fe22
SHA512 d0395b8988889d7778f171ae47081f30403127ad4c88d22ada93be032f128a3b485298230d1cc43fb0c4454019dec823ce2b08a98b6119b08c1e15496f7b0128
SSDEEP 384:qL7li/2zzq2DcEQvdQcJKLTp/NK9xaJy:0fMCQ9cJy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2636	tmp3D68.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2636	tmp3D68.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1580	4532	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe	82
PID 4532 wrote to memory of 1580	4532	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe	82
PID 4532 wrote to memory of 1580	4532	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe	82
PID 1580 wrote to memory of 2120	1580	vbc.exe	84
PID 1580 wrote to memory of 2120	1580	vbc.exe	84
PID 1580 wrote to memory of 2120	1580	vbc.exe	84
PID 4532 wrote to memory of 2636	4532	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe	85
PID 4532 wrote to memory of 2636	4532	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe	85
PID 4532 wrote to memory of 2636	4532	72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bpnvx5ey\bpnvx5ey.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F0C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDF7E44DE6FE489396CA11D825C16642.TMP"
    3⤵
    PID:2120
- C:\Users\Admin\AppData\Local\Temp\tmp3D68.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3D68.tmp.exe" C:\Users\Admin\AppData\Local\Temp\72f8d0a0bdddb921ff9fe7e366b9d250_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 cbb5f014a6cebe0898332e05b18ca3750835256da9585011f484bf77f3f861ff
MD5 082bc5c6dab905e27449ff74c87d5fcc
SHA1 20a4f16ca45d2ca830cab5e0b671cb78de80f826
SHA512 e3d3d8d1eb9ba3549906893f22fe7d0573808d47e24f0d0e2651b03423a73546ecae2232569e3524419b92600ec34e7b83ee3567aaa06282bd064cf477c22267
MD5 SHA1 SHA512

Submit Download

RES3F0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3F0C.tmp
Size 1KB
SHA256 7d4c47b57320b9db1f2f3cd52857ccbf7e7695005a6a9b5f98c4d225e87f0ea4
MD5 23d5eb1faab50765f22cdbdaf85a6123
SHA1 40d6d76df4be07078e5af9ef8d28ba9f93353cbf
SHA512 bdad1c47753e86297116201c425b7180efa31d0a864748b88ef82e36b9bed4648888e040147d504ec592ddcac016880d86443902f86b61104112112ae926a274
MD5 SHA1 SHA512

Submit Download

bpnvx5ey.0.vb

Path C:\Users\Admin\AppData\Local\Temp\bpnvx5ey\bpnvx5ey.0.vb
Size 2KB
SHA256 cc0976e716aebda43c84cd9ffd35b58cf8969027fd59cbbe1fad12e5325fd5e0
MD5 7c08076a3618452f411b798942a34a1f
SHA1 6fff586eeb279a7e1d0a82fac4fd2c95268572d9
SHA512 8169ed0bbad98850ba3881bbc95def778fc375643ce102837674611aeb129b1fd02284f28edfbf2ee1f075a997ebd6d71270dbb13e2b54c6b06084ec4c444981
MD5 SHA1 SHA512

Submit Download

bpnvx5ey.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bpnvx5ey\bpnvx5ey.cmdline
Size 273B
SHA256 87116939614784ecba17ef244014939835bf4b49f1c74961d887bd238bbb4bac
MD5 f5fd2811bca1c4f12c17c6f427f4d0ff
SHA1 cd6874a0f5c74af4eac701b14e67d447190bb083
SHA512 0f95e2c1de7577d1225ee39d26f9d7bb0353208362865ce44c119f6977e592cb7418ff2b0164eb45f4c648f33d978445ea6f4143ac65b8c891c2ce570233d312
MD5 SHA1 SHA512

Submit Download

tmp3D68.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3D68.tmp.exe
Size 12KB
SHA256 977078210d7fcc149a1f3fc08908ed4ce4f019328efbf29381a116d3741dfef4
MD5 99499e8bfea4c64548a784ed06132c6b
SHA1 c82dbce6f08aebd061847c46a09c3fbe16c2738e
SHA512 3e8c727ea10ce98d62cf922b5f145e3cc86b0f8bdd8ba227a0a4ad63c38dace7ce3b2d8522b0c79773d2a38a0dc7a492fea6bf07408b83bd6b81fa3edb503139
SSDEEP 384:0L7li/2zSq2DcEQvdfcJKLTp/NK9xaz7:i6MZQ9cz7
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcDF7E44DE6FE489396CA11D825C16642.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDF7E44DE6FE489396CA11D825C16642.TMP
Size 1KB
SHA256 42de39187bcc24cfb1035047ba2a58e3e41f5f87cdfc6215a2b2142ee7b49d6a
MD5 a1085a280dd840c3962da1c2ece0cd4f
SHA1 6eb967eb5f224bc83568bd84401a5df0545cc479
SHA512 ac06e39649b4920347592a1d39b2dbc75650438e10e5fb512f09c8a7097bcf2b501b4d075ce473ccea069aa237070efdacb5eeef929581dd0f76a34ff6df0bcb
MD5 SHA1 SHA512

Submit Download

memory/2636-24-0x0000000074EB0000-0x0000000075660000-memory.dmp

Download

memory/2636-25-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

Download

memory/2636-27-0x0000000005C80000-0x0000000006224000-memory.dmp

Download

memory/2636-28-0x0000000005770000-0x0000000005802000-memory.dmp

Download

memory/2636-30-0x0000000074EB0000-0x0000000075660000-memory.dmp

Download

memory/4532-0-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

Download

memory/4532-8-0x0000000074EB0000-0x0000000075660000-memory.dmp

Download

memory/4532-2-0x00000000051A0000-0x000000000523C000-memory.dmp

Download

memory/4532-1-0x0000000000800000-0x000000000080A000-memory.dmp

Download

memory/4532-26-0x0000000074EB0000-0x0000000075660000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads