Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe
- Size 49KB
- Sample240613-abeldszdrj
- SHA256 1aa927f3cdbc12a79f1fdc9f245e701a8f521c1175c11dcc4c6d035b88a7d144
- MD5 4e87c32906aa17e569380b93197a8420
- SHA1 f4264eab1233ef8caa5c5fa6cfc7a8a22807e1af
- SHA512 272efc7e2002b8a4fd1f8e8d790150b886287aaf6a5d97eb583725fbd6c01bf12eaca3c94d225a444c30622e3688d524153e4753184dd4548aead8ec52ef6e1b
- SSDEEP 768:mzQYScGrIubHuYtvdxwYHw5FAe2QBncwx9vMdJTeTXpnHTkGrbHdrzxDvDInsO:gQTIubHy5wQBJAejpzkGdxDLIN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 4660 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\c374c088\jusched.exe 4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe File created C:\Program Files (x86)\c374c088\c374c088 4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe 4660 jusched.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1844 wrote to memory of 4660 1844 4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe 85 PID 1844 wrote to memory of 4660 1844 4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe 85 PID 1844 wrote to memory of 4660 1844 4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e87c32906aa17e569380b93197a8420_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\c374c088\jusched.exe"C:\Program Files (x86)\c374c088\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\c374c088\c374c088
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\c374c088\jusched.exe
- Size 49KB
- SHA256 2ddc11ee3d92f890e165ac2fe0453f12eb96550bfb05deb106e4f55adae360a0
- MD5 20ae300575d8e01b87ec43c79527624e
- SHA1 676ba89832c035d7cbde6b1087af6aab20505e22
- SHA512 3af807baa1add8dd293e670eb7cee3ef8725fc71898f8cdef475ef45330dacba7db9bd49b6c0504fef14a26a7f7732fb96d5b2aea1f1995bb125ef1b27bc6b29
- SSDEEP 768:mzQYScGrIubHuYtvdxwYHw5FAe2QZncwx9vMdJTeTXpnHTkGrbHdrzxDvDInsU:gQTIubHy5wQZJAejpzkGdxDLIR
- MD5 SHA1 SHA512 SSDEEP