d93ac8d227441ca127d76c51bd85a1205b7d3393f6b15e1290cec16785e4ee7a

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
169d837d63638c194d79d8101c492510_NeikiAnalytics.exe
Size 12KB
Sample240609-jly78age63
SHA256 d93ac8d227441ca127d76c51bd85a1205b7d3393f6b15e1290cec16785e4ee7a
MD5 169d837d63638c194d79d8101c492510
SHA1 2dea6dd272889f242b2e25819efea7cb5dabca14
SHA512 288f8bd0f1aa6e81b49381f88760b377d27e1f2cb6e8f6cb54feb67273fea2f7d39a408543e11acd91ea609cfefa40fd86f552fa9d60f8333320c70f90fcd32e
SSDEEP 384:ML7li/2zJq2DcEQvdhcJKLTp/NK9xaGG:KJM/Q9cGG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
5052	tmp4AA6.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
5052	tmp4AA6.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4108	2904	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe	86
PID 2904 wrote to memory of 4108	2904	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe	86
PID 2904 wrote to memory of 4108	2904	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe	86
PID 4108 wrote to memory of 4140	4108	vbc.exe	88
PID 4108 wrote to memory of 4140	4108	vbc.exe	88
PID 4108 wrote to memory of 4140	4108	vbc.exe	88
PID 2904 wrote to memory of 5052	2904	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe	89
PID 2904 wrote to memory of 5052	2904	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe	89
PID 2904 wrote to memory of 5052	2904	169d837d63638c194d79d8101c492510_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\169d837d63638c194d79d8101c492510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\169d837d63638c194d79d8101c492510_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2nfw1yay\2nfw1yay.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CA9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc68BFE882BF864CA980A1956F8EFDE680.TMP"
    3⤵
    PID:4140
- C:\Users\Admin\AppData\Local\Temp\tmp4AA6.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4AA6.tmp.exe" C:\Users\Admin\AppData\Local\Temp\169d837d63638c194d79d8101c492510_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2nfw1yay.0.vb

Path C:\Users\Admin\AppData\Local\Temp\2nfw1yay\2nfw1yay.0.vb
Size 2KB
SHA256 1338cbe18608fc99931748ab3eab6b13edffaa5333bf34ed4ad392c398bfb7fe
MD5 745d7efed54e615ee4a4171f53144e27
SHA1 f08d8faeca7b27bb9e9ebd3383444c87c1d6aaf0
SHA512 ba40de65b6a78af7501bb4f1d19d9bfa42e9a4a72619414a93bf63c94df3e9a9e655109c221ca5e6aa84f19fc768822a2cc16d7f37e3930dbbde222eb30d2119
MD5 SHA1 SHA512

Submit Download

2nfw1yay.cmdline

Path C:\Users\Admin\AppData\Local\Temp\2nfw1yay\2nfw1yay.cmdline
Size 273B
SHA256 464b4f75eab2cb01b22c91f6edab3c13297df575d77521cb4394772ac54f0bb1
MD5 12695037c226b8a6de02b224e3728593
SHA1 3521de6e251ca709801fa9a8cd467aa119f1f46d
SHA512 9d561549d9c6ca33c8ccc2c85f56f7f78e3dff4da26b297d6c5a7b9c2e9a667d011324ea0236b18e54f421f3b691f6a0458892450909be54d78da1f5d0243e5c
MD5 SHA1 SHA512

Submit Download

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 354255ad3f257c1489342b52ca1b464e5293f20a89bd7e796b01f8574ac8094a
MD5 0afc1a8855a35f2ebe6561f361e1a98a
SHA1 a8f5432f431a17e37d54538b4c716d12a6fb58e0
SHA512 ece63e0b2f30f77706f6000b661706ec75c5adc763f33de26a032c25719bdba92c28c6ecc35bd938b28b2de61565b4a0826fb325db8e7f97a875e065ff835f19
MD5 SHA1 SHA512

Submit Download

RES4CA9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4CA9.tmp
Size 1KB
SHA256 bc3e2460b972bf3eedeba633370c5ab5e2e03882f576ac2236906745b853e376
MD5 a04402074e5ff832c1342ad51fc8543a
SHA1 20cc3e90aa4a1da9b87685f359eaafb21f29cae2
SHA512 dacc06d46177ba11e62aabdca4dfac3cc69b496a35a28e5beac793fca61c119956063758327f4c79e8c8aa05a8c10c9b7db1a499f1c8f8f6476e1433b3c569e4
MD5 SHA1 SHA512

Submit Download

tmp4AA6.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4AA6.tmp.exe
Size 12KB
SHA256 96b21aefec0a7d36a8396b0869333b9c87d931f994ecbc6326113a39faf0b858
MD5 f75cf643ea8e631fa17a1a3478d94f21
SHA1 e1d071e6b5822ab04062a42b0e7b4af437c0e673
SHA512 fa2942c6625730b2c013a15206b9138699fae1bc11ace0c3a1d0bf13f8691215257aee163b681cfef74be154863191f85163bec14765ae37d082bc408489a81b
SSDEEP 384:eL7li/2zgq2DcEQvdfcJKLTp/NK9xaWu:IUMZQ9cWu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc68BFE882BF864CA980A1956F8EFDE680.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc68BFE882BF864CA980A1956F8EFDE680.TMP
Size 1KB
SHA256 c75067e47ac9d02638ee37fb83c1ae61c028b19bee1254f976e0e0cc8f959bc1
MD5 b84dc7a69569fea9bb9834db11b7c649
SHA1 4289fa1fddb7bf5b3774e1eeb0abb7f59bce7806
SHA512 32e8749aaaaceeb8b4e2df75fb054dc635a42d691cc378e5657d61dddd47d1cc179a9dbb0c14b778bfeece69b60e4a4991ed607390db5f9e7787e46e3b17c781
MD5 SHA1 SHA512

Submit Download

memory/2904-8-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/2904-2-0x0000000004F90000-0x000000000502C000-memory.dmp

Download

memory/2904-1-0x0000000000610000-0x000000000061A000-memory.dmp

Download

memory/2904-0-0x000000007467E000-0x000000007467F000-memory.dmp

Download

memory/2904-24-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/5052-25-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/5052-26-0x00000000008D0000-0x00000000008DA000-memory.dmp

Download

memory/5052-27-0x00000000057E0000-0x0000000005D84000-memory.dmp

Download

memory/5052-28-0x0000000005230000-0x00000000052C2000-memory.dmp

Download

memory/5052-30-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads