8c0abc3f28f6614999f4ce3c78c8f2cdf637a6eef4877e123ebf27fcbce5ebe9

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe
Size 12KB
Sample240612-eht2wazgqb
SHA256 8c0abc3f28f6614999f4ce3c78c8f2cdf637a6eef4877e123ebf27fcbce5ebe9
MD5 1ca0b0e04fabbbff72dedd49f87e8500
SHA1 80fd706755bc6609c56d9edcb8b51602e7123594
SHA512 f2273e659e6ea7bc549034c6bd833c3c905a62f5253fa4a1e0b88e9dfe766f9be97adeddbfe1fab4aa900992dedb0ce3a9902c49103c960446e950c11232c6d5
SSDEEP 384:cL7li/2zvq2DcEQvdQcJKLTp/NK9xaQ/:6bMCQ9cQ/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2188	tmp9079.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2188	tmp9079.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 5084	2348	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe	86
PID 2348 wrote to memory of 5084	2348	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe	86
PID 2348 wrote to memory of 5084	2348	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe	86
PID 5084 wrote to memory of 2928	5084	vbc.exe	88
PID 5084 wrote to memory of 2928	5084	vbc.exe	88
PID 5084 wrote to memory of 2928	5084	vbc.exe	88
PID 2348 wrote to memory of 2188	2348	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe	89
PID 2348 wrote to memory of 2188	2348	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe	89
PID 2348 wrote to memory of 2188	2348	1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wa2rn2bi\wa2rn2bi.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91D0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6EC36B45708B41BD84B82088CC71A.TMP"
    3⤵
    PID:2928
- C:\Users\Admin\AppData\Local\Temp\tmp9079.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9079.tmp.exe" C:\Users\Admin\AppData\Local\Temp\1ca0b0e04fabbbff72dedd49f87e8500_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 779074d4148ecee1a81be216097887a53e67aa9cdf453a38ab17ab17a700cad1
MD5 47237505799d67ad3736e8b16986ed34
SHA1 87fdcecf6a0ed1f3e3f4d3a3841968656f9986ed
SHA512 8298b9a9956d1ea220def636cb1bee4f9031b39c365c6a14bffb71dc54ede5642127997ec4ad1e384e9ad5884b291db0e493e5d18b537045b7908da2464c01e3
MD5 SHA1 SHA512

Submit Download

RES91D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES91D0.tmp
Size 1KB
SHA256 df17e961ef7c7cba7e34b774fc6334203fbdf5f9506b88d7b0a4b06b11ea5aa6
MD5 78cbaa1f2fc6d660c40dd3ae7503a90b
SHA1 0e1e6242bb3799ef92eef6c216a91fd5c68b2118
SHA512 5af23c3d526747a740cb0bf462079ae5b324fa197ed35720d150efeed47a61d0423945fe93a34e91a7b7f916415b110de471f1c01ca0f63205fa38a9d5297368
MD5 SHA1 SHA512

Submit Download

tmp9079.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp9079.tmp.exe
Size 12KB
SHA256 77836428f404047edee0df2c2fcb5f63bfcf913ca881d0cd081ab16b09e2b1fa
MD5 4c4ef4957280108409bb1b97dafe1b9a
SHA1 66f9f9b551b8e87cc72f8503f627a77de7570252
SHA512 a3d25722eac4eaccab33148220e20bdb65e6e0c7bdb1e4c4f9e6eb610a688bc1ad0e33099725ae4c074ee3c71b1140ccd10c49bd54f5554991c61ba9878871e2
SSDEEP 384:FL7li/2znq2DcEQvdfcJKLTp/NK9xawN:FTMZQ9cwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc6EC36B45708B41BD84B82088CC71A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc6EC36B45708B41BD84B82088CC71A.TMP
Size 1KB
SHA256 557146c9541a226c4cf9e9c2ef23c55c6b86abb6ce66e2fe1fbd541159f2f3e2
MD5 0d83848a87bc6b4951b2a3993786ecfd
SHA1 629e5ab48fb4937b0c1bdbf33704f6a71898132d
SHA512 d82e3f9ad10527647cb5a0fda0b3b1c8b6d513958593b41efe4eb2241594549c041d7da2c3fa4ba08836e9507139f86c8fabf3815a31a1d31fe5b27ed6953ddc
MD5 SHA1 SHA512

Submit Download

wa2rn2bi.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wa2rn2bi\wa2rn2bi.0.vb
Size 2KB
SHA256 e330ad25f600eef3a6e761c20b09fc4871ccb6e42406c8896dead9b5c3c445e2
MD5 60edaee99b0ff1dfd71264f2df3cd2f3
SHA1 bb1d8d7152d857e21ae383573302e0533f3412d1
SHA512 043bcef64b140a0e1e463e78a4535773288fe40ec8e2c24f897d35e4b1720ee5c0511c62d6059cfa18e95ff4e3437f715cc155a41facbf3e0ad11b67665c56c6
MD5 SHA1 SHA512

Submit Download

wa2rn2bi.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wa2rn2bi\wa2rn2bi.cmdline
Size 273B
SHA256 02f64275d4b77dee4687d2b369df1cf9e61ec40edd0668c38ea86c4b6ca2ee2e
MD5 9c2cf9f13a8bbd9cdfbb136aa645435d
SHA1 a49f45508f44c9accf480c43fae08c4e81b3f835
SHA512 87bff5b1fd01bb6aa4fd43ba9840226fda34272fa20abefc24d459f13cfc53b788088f43738205a8c6095503d75266b131532930b2c7f06dd82b0fbe27681a1f
MD5 SHA1 SHA512

Submit Download

memory/2188-25-0x0000000000010000-0x000000000001A000-memory.dmp

Download

memory/2188-26-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2188-27-0x0000000004F70000-0x0000000005514000-memory.dmp

Download

memory/2188-28-0x00000000049C0000-0x0000000004A52000-memory.dmp

Download

memory/2188-30-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2348-0-0x000000007481E000-0x000000007481F000-memory.dmp

Download

memory/2348-8-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2348-2-0x0000000004DD0000-0x0000000004E6C000-memory.dmp

Download

memory/2348-1-0x0000000000390000-0x000000000039A000-memory.dmp

Download

memory/2348-24-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads