5541bdf9b78ae20d96c0ded574800d746938255d4f60f698cebbc89443998fb5

Analysis

max time kernel
144s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe
Size 2.7MB
Sample240613-1f4des1cle
SHA256 5541bdf9b78ae20d96c0ded574800d746938255d4f60f698cebbc89443998fb5
MD5 89113766f525742ff7704dc32c5cad40
SHA1 ad9f9d74148522d4137d6cf31f7c60c35c7d1df4
SHA512 10584891ae057d66182c41eaa317f6170e3cdb11cc2676d25c5f868539ff6e91413f2e4156c9b25764cee892bf19b9cf346787414378cb9a598bc0da23b7601a
SSDEEP 49152:lBuZrEUwflhYOcfruJX+Kf6evrKf7lKIy029s4C1eH90:DkLwflKWp+KNrsVt29s4C1eH90
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp

Executes dropped EXE 4 IoCs

pid	Process
1984	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
3440	66301befa131e_pe.exe
2748	66301befa131e_pe.tmp

Loads dropped DLL 3 IoCs

pid	Process
1984	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
2748	66301befa131e_pe.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Ulead videostudio.exe\unins000.dat	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
File created	C:\Program Files (x86)\Ulead videostudio.exe\is-OIB6H.tmp	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
File opened for modification	C:\Program Files (x86)\Ulead videostudio.exe\unins000.dat	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1984	1356	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe	82
PID 1356 wrote to memory of 1984	1356	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe	82
PID 1356 wrote to memory of 1984	1356	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe	82
PID 1984 wrote to memory of 948	1984	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp	84
PID 1984 wrote to memory of 948	1984	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp	84
PID 1984 wrote to memory of 948	1984	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp	84
PID 948 wrote to memory of 4112	948	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe	85
PID 948 wrote to memory of 4112	948	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe	85
PID 948 wrote to memory of 4112	948	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe	85
PID 4112 wrote to memory of 3440	4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp	88
PID 4112 wrote to memory of 3440	4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp	88
PID 4112 wrote to memory of 3440	4112	89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp	88
PID 3440 wrote to memory of 2748	3440	66301befa131e_pe.exe	89
PID 3440 wrote to memory of 2748	3440	66301befa131e_pe.exe	89
PID 3440 wrote to memory of 2748	3440	66301befa131e_pe.exe	89

C:\Users\Admin\AppData\Local\Temp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\is-I5AC8.tmp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-I5AC8.tmp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp" /SL5="$501F2,1970012,832512,C:\Users\Admin\AppData\Local\Temp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe" /SILENT /PASSWORD=53688818
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\is-1SESA.tmp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1SESA.tmp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp" /SL5="$601F2,1970012,832512,C:\Users\Admin\AppData\Local\Temp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.exe" /SILENT /PASSWORD=53688818
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\is-ESVP9.tmp\66301befa131e_pe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-ESVP9.tmp\66301befa131e_pe.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\is-4U3T4.tmp\66301befa131e_pe.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4U3T4.tmp\66301befa131e_pe.tmp" /SL5="$20224,922170,832512,C:\Users\Admin\AppData\Local\Temp\is-ESVP9.tmp\66301befa131e_pe.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

66301befa131e_pe.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4U3T4.tmp\66301befa131e_pe.tmp
Size 3.1MB
SHA256 78507539e68558cb11b438ebb8861c00ceec33965c9440a7a50c75c959e60ba0
MD5 3ad13d2fcad36c221d3022ddb7826936
SHA1 bd8a47bbc9287f3837def674cdc69329cba91b14
SHA512 d523499c08688b9c1895af193c0366d99faad6cca24721841ac77de2e6e14df9b4efe5878bafd53089510f3d7ee88f23b1238c245275f2ce0572352cdf54c3ba
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-6VJET.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-7L11P.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

66301befa131e_pe.exe

Path C:\Users\Admin\AppData\Local\Temp\is-ESVP9.tmp\66301befa131e_pe.exe
Size 1.7MB
SHA256 50d38d506b86d1eff95b0d421cfdce25e8199151acf06e06fd3dcaba7519f7e3
MD5 52d8beb3daab4bc53572797e1924d70e
SHA1 0fb04c6bae50b54c869da5127e15287d42fc5779
SHA512 b59c2a5d0defce20d5e76728b7c112cf7f1fb5cb7debea6fe6107e7f1b791ed3230c021b9e220e99491fe3536d4fd8618efe75fd3a5c5f2b47e10d474aa0c55a
SSDEEP 24576:s7FUDowAyrTVE3U5F/GGqK+Kic6QL3E2vVsjECUAQT45deRV9Rt:sBuZrEUzYKIy029s4C1eH9H
MD5 SHA1 SHA512 SSDEEP

Submit Download

89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-I5AC8.tmp\89113766f525742ff7704dc32c5cad40_NeikiAnalytics.tmp
Size 3.1MB
SHA256 5e022b970da5e8d82157b5f58b06b5386fb53077ba34168c5820a98d54140766
MD5 d76f4ac62d46be31d1fb3c0216489e4a
SHA1 3393f243eb2c9742b1c9ea15358ac461f7a088c4
SHA512 609b3871d08a60a85857edd3345e3bc068529e9165dd1923b5ff81b44725ab962deea31929b43c2dbcd6397b1e19fc323516fde07698ac889b11fa02a74d05fe
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-15-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/948-13-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/948-47-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1356-20-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1356-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1356-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/1984-6-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/1984-17-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2748-50-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3440-36-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/3440-49-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4112-27-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/4112-48-0x0000000000400000-0x000000000071C000-memory.dmp

Download