b539986224c3021bd414bcb46958a23e6293f6027dd777ca6cec29bd2a12869b

General

Target
32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe
Size 7.4MB
Sample240611-m92j2avbrc
SHA256 b539986224c3021bd414bcb46958a23e6293f6027dd777ca6cec29bd2a12869b
MD5 32b68c6d1a5aaf5926b8dd12744c0240
SHA1 7f983a9a13047a904c8353b0bc33cf70fed12349
SHA512 18e25f407bd1be3e0d7ddee4f1e26b4554bf38b6e5454f98cc0b20f7d080222aae2054e7c3f17a73b1b7e5d083f34e38e42b6620323e1295cfc20535aca562aa
SSDEEP 196608:XmvJxbAQ5owejuJDUX47dwdW0tn3BTYPERR:WxCaUX47d4BdZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	INST.exe

Executes dropped EXE 1 IoCs

pid	Process
392	INST.exe

Loads dropped DLL 3 IoCs

pid	Process
3716	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe
3716	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe
3716	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3716	1524	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe	84
PID 1524 wrote to memory of 3716	1524	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe	84
PID 3716 wrote to memory of 4036	3716	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe	87
PID 3716 wrote to memory of 4036	3716	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe	87
PID 3716 wrote to memory of 3880	3716	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe	88
PID 3716 wrote to memory of 3880	3716	32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe	88
PID 3880 wrote to memory of 392	3880	cmd.exe	89
PID 3880 wrote to memory of 392	3880	cmd.exe	89
PID 3880 wrote to memory of 392	3880	cmd.exe	89
PID 392 wrote to memory of 1640	392	INST.exe	91
PID 392 wrote to memory of 1640	392	INST.exe	91

C:\Users\Admin\AppData\Local\Temp\32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\32b68c6d1a5aaf5926b8dd12744c0240_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c echo %temp%
    3⤵
    PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\INST.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\INST.exe
      C:\Users\Admin\AppData\Local\Temp\INST.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Windows\system32\wscript.exe
        
        "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4A38.tmp\4A39.tmp\4A3A.vbs //Nologo
        5⤵
        
        PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A3A.vbs

Path C:\Users\Admin\AppData\Local\Temp\4A38.tmp\4A39.tmp\4A3A.vbs
Size 882B
SHA256 7c99830f59df6bd245fa56cac9a4aa6232d81978cc2b01af11c4f14fb5f53436
MD5 236b8900d6b2cbfbfac1529a2cad10ca
SHA1 1302690241eebc67d7d5d760917fd18b75d4e323
SHA512 9c214e3272ab3a02260c31fb35a2594269136973e07d56568fdb393d732ee5449600b66d6cdb4ba7378c142cb661fb83c1cbc982d2028ebecbd1edb3eae1b2cb
MD5 SHA1 SHA512

Submit Download

INST.exe

Path C:\Users\Admin\AppData\Local\Temp\INST.exe
Size 84KB
SHA256 c19ee678472fee1b4c0705601ee51b3b3d5962ba619451d4902969619fdc8f58
MD5 a0c6949559a0280bc979446e4ab50467
SHA1 a87be0e0b650207f59f32cecd65b1c033069e833
SHA512 f73280ea85d932408f90322745f0e44bd3ba18427d4f40ce46e2b666774b8faa324169c040d4f71a6242a9693bc021e2ecc343500546a5b9c051e308ca96f471
SSDEEP 1536:M7fy7CyfphIMvMpICdHkXMXakLC5PNNg1qCXxaIOlnToIfrIIOC:CamXeCtkCubJCXxoNTBfrIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15242\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI15242\base_library.zip
Size 1.7MB
SHA256 65ebc074b147d65841a467a49f30a5f2f54659a0cc5dc31411467263a37c02df
MD5 948430bbba768d83a37fc725d7d31fbb
SHA1 e00d912fe85156f61fd8cd109d840d2d69b9629b
SHA512 aad73403964228ed690ce3c5383e672b76690f776d4ff38792544c67e6d7b54eb56dd6653f4a89f7954752dae78ca35f738e000ffff07fdfb8ef2af708643186
SSDEEP 24576:mQR5pATt7xm4lUKdcubgAnyfbls0iwhpM2dYf9P3sLGTWLdma0uHHo:mQR5pQxmhG+jLgaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15242\python311.dll
Size 5.5MB
SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
MD5 1fe47c83669491bf38a949253d7d960f
SHA1 de5cc181c0e26cbcb31309fe00d9f2f5264d2b25
SHA512 05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4
SSDEEP 98304:ZjCxzAISyt+EaudO141ibXHkMLyP59mJ3:ZjCxzAISXElO13L09
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15242\ucrtbase.dll
Size 986KB
SHA256 e06993a4b8f16da8fc37da141f2a8aa9bde7e8f33e9a661777297a6821c4da4e
MD5 9f75867fca8fbb1103bfb52a258c534f
SHA1 09ce0471c1267126ac0cc64ca503e08e31c837ab
SHA512 9887f86f5c7cb51824aad65037000177cff7d9812c8f49caba670d83a8bfa6fa2f0810a763efa47017e636888bf5eba67e445a02b641d248a58250076e13ad49
SSDEEP 24576:2kmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkR:zmZFHhp9v1Io3h0TN3pvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads