b52e8270881e64ad873a99b06bd115000f4000ff3951ed4198570af78304c021

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe
Size 12KB
Sample240609-h8pfvsfe5t
SHA256 b52e8270881e64ad873a99b06bd115000f4000ff3951ed4198570af78304c021
MD5 15f5f8505c5366fe5f4054e59f6e7700
SHA1 7c5378381072df74132b2d39d278bb8b6e5f4604
SHA512 dbbcf24f9a411bea6e3bf34c16fa9f2d0928f4cd9ece32c26aba834c45537cb175541dbb27c27c4f1d703c8c4872772898a258c6d400df62e8648395eb993dba
SSDEEP 384:RL7li/2zAq2DcEQvdhcJKLTp/NK9xawk:RMM/Q9cwk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
1780	tmp4DB3.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1780	tmp4DB3.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3424	4520	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe	85
PID 4520 wrote to memory of 3424	4520	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe	85
PID 4520 wrote to memory of 3424	4520	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe	85
PID 3424 wrote to memory of 2268	3424	vbc.exe	87
PID 3424 wrote to memory of 2268	3424	vbc.exe	87
PID 3424 wrote to memory of 2268	3424	vbc.exe	87
PID 4520 wrote to memory of 1780	4520	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe	90
PID 4520 wrote to memory of 1780	4520	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe	90
PID 4520 wrote to memory of 1780	4520	15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q1ed4xjp\q1ed4xjp.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5052.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1047AC81B47A4B00BCE92817F4520FF.TMP"
    3⤵
    PID:2268
- C:\Users\Admin\AppData\Local\Temp\tmp4DB3.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4DB3.tmp.exe" C:\Users\Admin\AppData\Local\Temp\15f5f8505c5366fe5f4054e59f6e7700_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 6018c4c5e902119f521ad694cfae5816683da1d3ff29e6d098e19bf017b8fd44
MD5 5621209dc7dbb170b9bf0751aa3e7923
SHA1 0e59650dc61ed9527c4c612b42e515beaa0f436a
SHA512 3288c7f342d665bb51f7e3e2a75f068cde5ed290a6abd521db746e4ae9be620ea70d3e9ff9b75f3d369404dad6cae693d05d6dd75f7b7d3a4f628a53bfb4048d
MD5 SHA1 SHA512

Submit Download

RES5052.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5052.tmp
Size 1KB
SHA256 5ed75b6c8a1a773a67fa5aa1f3bfce0a825ba7189fae3c7f71741c4db2b5b979
MD5 9c4eb194605bd990d4e00cb7732cf9e7
SHA1 da940faa016b0fb80f79b7ef632abc835bbba5bf
SHA512 fdb888c00a5481947bcf1bce05c7e4bcb8b34db12cb9d2e6697105f1077c4b4510114f86ead80b0ef93b536c11cb2952f1096fcca574ef66a6ac23fbf22fb518
MD5 SHA1 SHA512

Submit Download

q1ed4xjp.0.vb

Path C:\Users\Admin\AppData\Local\Temp\q1ed4xjp\q1ed4xjp.0.vb
Size 2KB
SHA256 45fc66bc4dc67d0f9535dc33e7c94c7dfd131f54c70ede47a0922431f9e7ebe2
MD5 cdf2bd789086fdb92d6a3e6a66114d2f
SHA1 5eeff5f75f2da6a4c3f94408ecfbe05d6a398ae8
SHA512 626a9b31edba65a6153a44415ecdea76f61cb4b394601823fd6528635aa79d298dba206efcfc80b95c002ea8fa74743824379784886c1c17b7141d1412928c0d
MD5 SHA1 SHA512

Submit Download

q1ed4xjp.cmdline

Path C:\Users\Admin\AppData\Local\Temp\q1ed4xjp\q1ed4xjp.cmdline
Size 273B
SHA256 0de71897dfd512b05d3e0af44f63b6c56f9f1b47ce71f7c84cd1e52b06a2befc
MD5 11e42a15f1a386ef24d2460f3e31bb82
SHA1 db04e0857676d6b7c60460e9b6969160d42e717e
SHA512 0ffc2996a050e79abf96fec3ea2376789246db7ebe776ae6678f883eca3174b792960ab62b1b174e413b3315776bfc5bb68c85229207b4410cc79b234841d756
MD5 SHA1 SHA512

Submit Download

tmp4DB3.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4DB3.tmp.exe
Size 12KB
SHA256 dc8b313a03f24f957e2836b7701d89a1559918f5d6d48425ef637babc281e8d0
MD5 5cd3bdb66e47649fb09476124d0d24dc
SHA1 90306291d46106bed782f1f8a7cba5b6a9e36d27
SHA512 e7b07339802aa6282ae13b6c065ba2bd0626566e353f501451e93ab1fb312c8f943d0e05426faae05b1e4fe3cff8b75f185759da337532161ba6456ff6ad31c6
SSDEEP 384:2L7li/2z9q2DcEQvdfcJKLTp/NK9xalb:wFMZQ9clb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc1047AC81B47A4B00BCE92817F4520FF.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1047AC81B47A4B00BCE92817F4520FF.TMP
Size 1KB
SHA256 c44cbfded139dd3b339b02a07e843c73fe1b29738c4d72c93f8655de65dc6a61
MD5 0ae1e498645267b58364ce53d3c98e18
SHA1 a084ec7eaca12005f362175b33b6fe46dddac9e8
SHA512 d01573c35b9d6c604e04ea4b74f7c83367820ff188232f581a663d78c091a497797ee11e038619a0288d1bdd5b6e52fa70d1332f0ad6dbae801662069e5f2a57
MD5 SHA1 SHA512

Submit Download

memory/1780-26-0x00000000004D0000-0x00000000004DA000-memory.dmp

Download

memory/1780-25-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/1780-27-0x0000000005370000-0x0000000005914000-memory.dmp

Download

memory/1780-28-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Download

memory/1780-30-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4520-0-0x000000007464E000-0x000000007464F000-memory.dmp

Download

memory/4520-8-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4520-2-0x0000000005880000-0x000000000591C000-memory.dmp

Download

memory/4520-1-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

Download

memory/4520-24-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads