Malware Analysis Report

2025-01-18 12:50

Sample ID 240613-1wed8swajn
Target 8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe
SHA256 ba898f05f347722f00737f2e70d80daa934c102142154ff2a7208a5ae2f4000f
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

ba898f05f347722f00737f2e70d80daa934c102142154ff2a7208a5ae2f4000f

Threat Level: Shows suspicious behavior

The file 8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 21:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 21:59

Reported

2024-06-13 22:02

Platform

win7-20240220-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\WINDOWS\VWFLH\rMX.exe N/A
N/A N/A C:\WINDOWS\VWFLH\rMX.exe.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\WINDOWS\VWFLH\rMX.exe C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe N/A
File created \??\c:\windows\rMX.exe.bat C:\WINDOWS\VWFLH\rMX.exe N/A
File created C:\WINDOWS\VWFLH\rMX.exe.exe C:\WINDOWS\VWFLH\rMX.exe N/A
File opened for modification C:\WINDOWS\VWFLH\rMX.exe.exe C:\WINDOWS\VWFLH\rMX.exe N/A
File opened for modification \??\c:\windows\nk.txt C:\Windows\SysWOW64\cmd.exe N/A
File created C:\WINDOWS\VWFLH\rMX.exe C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\WINDOWS\VWFLH\rMX.exe
PID 2356 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\WINDOWS\VWFLH\rMX.exe
PID 2356 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\WINDOWS\VWFLH\rMX.exe
PID 2356 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\WINDOWS\VWFLH\rMX.exe
PID 3036 wrote to memory of 2396 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2396 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2396 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2396 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2208 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2208 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2208 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2208 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\VWFLH\rMX.exe.exe
PID 2208 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\VWFLH\rMX.exe.exe
PID 2208 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\VWFLH\rMX.exe.exe
PID 2208 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\VWFLH\rMX.exe.exe
PID 2704 wrote to memory of 2600 N/A C:\WINDOWS\VWFLH\rMX.exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2600 N/A C:\WINDOWS\VWFLH\rMX.exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2600 N/A C:\WINDOWS\VWFLH\rMX.exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2600 N/A C:\WINDOWS\VWFLH\rMX.exe.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3064 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3064 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3064 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2600 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2600 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2600 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2600 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe"

C:\WINDOWS\VWFLH\rMX.exe

C:\WINDOWS\VWFLH\rMX.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c echo 0>>c:\windows\nk.txt

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\WINDOWS\VWFLH\rMX.exe.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\72.vbs

C:\WINDOWS\VWFLH\rMX.exe.exe

C:\WINDOWS\VWFLH\rMX.exe.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\51.vbs

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\72.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\51.vbs"

Network

N/A

Files

C:\Windows\VWFLH\rMX.exe

MD5 8a4010ab205b0d866e3569278dec80d0
SHA1 34feead405b1fd554fa826fd712bb1addc10c4e9
SHA256 ba898f05f347722f00737f2e70d80daa934c102142154ff2a7208a5ae2f4000f
SHA512 1b34ccf7377f778529d87ed57fb9b1be851d912a11e61f0c44f632781598eaff68fe61cacea2fa81a5baf808b7a356e0e81bf74b1441dc941ecf3c0767122e87

memory/3036-13-0x000000007EEE0000-0x000000007EEFF000-memory.dmp

memory/2356-15-0x000000007EEE0000-0x000000007EEFF000-memory.dmp

\Windows\VWFLH\rMX.exe.exe

MD5 b55ae59c75ecc6cd08a8a19c11ce292d
SHA1 842414450e85bd60722e275d5702bcb0e8cef183
SHA256 e42cfede4d9e51f5f27e88def0a7c3d1064bdc9dcf0529741b816deb4fd84e18
SHA512 4fdb68561cd07d72e7caf1ff7e9728ffd8e27bf9c7705e43d511aa0c4b6aa859ea956c893f493ca5cc53255df4bc42512e3356a3f9102b9538eda15aa8253def

C:\72.vbs

MD5 94b774463df9e48b3c5ad4a51af55285
SHA1 962d59e4991e4e81af9434d5f0f4c816c9e93592
SHA256 7180e26bc9c741a5d2d05ca32260d8defac1326db71ade7c7943114a450d3289
SHA512 a0bf8c6f25d2cd9eed91972b567c53caa9fb8d634fda65a4f2ba5b7f927178a2a2876da86dddc28a8a23d465756ecba6b78734f210d8050a852f4b9a4430c570

memory/2704-28-0x000000007EEE0000-0x000000007EEFF000-memory.dmp

C:\51.vbs

MD5 c62dfa660bac6895cf009e2e33265347
SHA1 c0ca35400dcd7e7db069d63f08169adef99b1f6b
SHA256 8db28e197fe38cb938ac70cf19d4be19ed1a9e6386cc7fa5c67566928b00a73e
SHA512 683f8f388f2392413b980777539d4db12fcccea7fb752bebdf4f40f21164a4e5a02d5ac1c8b02fdc74698587de179753c027b0a74ae915724a2af9023803245e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 21:59

Reported

2024-06-13 22:02

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

58s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\WINDOWS\VWFLH\rMX.exe N/A
N/A N/A C:\WINDOWS\VWFLH\rMX.exe.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\nk.txt C:\Windows\SysWOW64\cmd.exe N/A
File created C:\WINDOWS\VWFLH\rMX.exe C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe N/A
File opened for modification C:\WINDOWS\VWFLH\rMX.exe C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe N/A
File created \??\c:\windows\rMX.exe.bat C:\WINDOWS\VWFLH\rMX.exe N/A
File created C:\WINDOWS\VWFLH\rMX.exe.exe C:\WINDOWS\VWFLH\rMX.exe N/A
File opened for modification C:\WINDOWS\VWFLH\rMX.exe.exe C:\WINDOWS\VWFLH\rMX.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3952 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\WINDOWS\VWFLH\rMX.exe
PID 3952 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\WINDOWS\VWFLH\rMX.exe
PID 3952 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\WINDOWS\VWFLH\rMX.exe
PID 4544 wrote to memory of 5016 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 5016 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 5016 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 3120 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 3120 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 3120 N/A C:\WINDOWS\VWFLH\rMX.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 3120 wrote to memory of 2920 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\VWFLH\rMX.exe.exe
PID 3120 wrote to memory of 2920 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\VWFLH\rMX.exe.exe
PID 3120 wrote to memory of 2920 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\VWFLH\rMX.exe.exe
PID 2920 wrote to memory of 5056 N/A C:\WINDOWS\VWFLH\rMX.exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 5056 N/A C:\WINDOWS\VWFLH\rMX.exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 5056 N/A C:\WINDOWS\VWFLH\rMX.exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 5056 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 5056 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 5056 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8a4010ab205b0d866e3569278dec80d0_NeikiAnalytics.exe"

C:\WINDOWS\VWFLH\rMX.exe

C:\WINDOWS\VWFLH\rMX.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c echo 0>>c:\windows\nk.txt

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\WINDOWS\VWFLH\rMX.exe.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\90.vbs

C:\WINDOWS\VWFLH\rMX.exe.exe

C:\WINDOWS\VWFLH\rMX.exe.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\98.vbs

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\90.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\98.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Windows\VWFLH\rMX.exe

MD5 8a4010ab205b0d866e3569278dec80d0
SHA1 34feead405b1fd554fa826fd712bb1addc10c4e9
SHA256 ba898f05f347722f00737f2e70d80daa934c102142154ff2a7208a5ae2f4000f
SHA512 1b34ccf7377f778529d87ed57fb9b1be851d912a11e61f0c44f632781598eaff68fe61cacea2fa81a5baf808b7a356e0e81bf74b1441dc941ecf3c0767122e87

memory/4544-9-0x000000007EEE0000-0x000000007EEFF000-memory.dmp

memory/3952-10-0x000000007EEE0000-0x000000007EEFF000-memory.dmp

C:\Windows\VWFLH\rMX.exe.exe

MD5 39c932a1ef77963e29cd40dde476de27
SHA1 a47ad082898a6002b39c2760a39bda6a230bef4d
SHA256 7057189dcdc6abee573f846d43616e7c52fb6cc599d7bb7801e70ca4123857b4
SHA512 a1170a7aca8953433cad2f1c199a2bf964fe637caffc0fa45a6ca4f948fdaf9a3ce4a001abb439ea7713d38f0496253a2220b60ee284238a59bda0405c0b3c11

memory/2920-15-0x000000007EEE0000-0x000000007EEFF000-memory.dmp

C:\90.vbs

MD5 5f4f6dd2b494fe449228b4d86ec04493
SHA1 33e2ba41c0ef6dfd11b4a95a2b64ad6bb5ae53cf
SHA256 51607b70e53a89d620d2f9e6f6c329eb7466c4c0f3fb0376fc759ed25f10ef57
SHA512 fa941716f875aa2128091891655a68c18596ee53979a615d34a0d7a1e5eac7dcd87064fab82a807b60a68d0f2cbe20594795e543a93a920964c2d3b182745930

C:\98.vbs

MD5 9f3751d95f7614ef778316696259756a
SHA1 7b629879bfbb01fae3b612ff304e5e5038e78931
SHA256 5e40312a83c32dc5fd40fb3b3385898b14d45eacbc49e2702cac8b25bc44e754
SHA512 5b91250c887061719db8c035718fa3b9059be69c3b7589752528691286d19a2f611eaf9cad44967a6feb2a272947e36eeb8e5d5e1fac110be10e089c7aafd8a1