Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 06:21

General

  • Target

    652132d22858cf85b4cbf387f759abf0_NeikiAnalytics.exe

  • Size

    12KB

  • MD5

    652132d22858cf85b4cbf387f759abf0

  • SHA1

    f6f050cb751575ffbd04c43fb104f3776d05a49d

  • SHA256

    2368452b449f64cc18419028e1c42ae095e4af3f3ff729d0600b4adf0b52c4e5

  • SHA512

    efbe671dedc2d1e2000e03918f239a46cdb900700a83877b91692413d77e10d4cd62388437360dc09bb17ba3d44c295e177848d229afa50d52d1e4dd4bb344e8

  • SSDEEP

    384:BL7li/2zAq2DcEQvd2cJKLTp/NK9xa1V:hMM8Q9c1V

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\652132d22858cf85b4cbf387f759abf0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\652132d22858cf85b4cbf387f759abf0_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uhgkdyfg\uhgkdyfg.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES511D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3302DD3A9AEF4D5A888576C7D0AE9C71.TMP"
        3⤵
          PID:4356
      • C:\Users\Admin\AppData\Local\Temp\tmp4F79.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp4F79.tmp.exe" C:\Users\Admin\AppData\Local\Temp\652132d22858cf85b4cbf387f759abf0_NeikiAnalytics.exe
        2⤵
        • Deletes itself
        • Executes dropped EXE
        PID:1016

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RE.resources

      Filesize

      2KB

      MD5

      0da6623e576193254e58434a9edd0c6e

      SHA1

      b5dbdde35bb55f3eaaa16b23f9674e8119772212

      SHA256

      ee3e0e4c400bc1c6a4d5aae76e6d44b7b5ede8751d9a5d6203d3580bf3c374e3

      SHA512

      7cf4c77bb35583ca52c33a528a2e04da2956832577436bb99fb676f81dbc3e8bcd2dcdce2ee1874c569d407b82ec6a72f1e5b6c5ad17b4c37a50433726f9b778

    • C:\Users\Admin\AppData\Local\Temp\RES511D.tmp

      Filesize

      1KB

      MD5

      0443f80cb452b7bfee29702ad29ab9df

      SHA1

      d043175a1ecb6a3e9c78c1593c85364d9e020dbc

      SHA256

      cea7b4596c41571d7bd84f9b91a330febc4dcecf15dab03214c8c44bf2cc8579

      SHA512

      f584e6b005e31b1fd455ee153667abe26aaa7c872335d557b18e93be647de5ad94cff0d4ac41e4523d5fe037947caab643d989af9ce9c9fcb31ddc696d59b9de

    • C:\Users\Admin\AppData\Local\Temp\tmp4F79.tmp.exe

      Filesize

      12KB

      MD5

      eac923fad827b0c3c9987e60e8aaf886

      SHA1

      30e246cf0b74eb100d9b6957ad7c329620e9ecdb

      SHA256

      d5e4e5a3c8a2968139952c22d1977720fb258f4a25c92ef48d2b2e3cd150fa99

      SHA512

      6ceeb213de8011a77f747923a4f066a10c4e28485499a1691c6109c075f954bcac0b32c57871009aa5d5a6cff9e0333816fe78c4b93f34e480985b9f6e4f2a50

    • C:\Users\Admin\AppData\Local\Temp\uhgkdyfg\uhgkdyfg.0.vb

      Filesize

      2KB

      MD5

      feea7bf0777d825ff6f463417ffe3118

      SHA1

      13b416c2bcaf75f47a53bdd01ef2b5bed716536c

      SHA256

      349ed88a0cfdd7c5274f43c931c87c5cf6ed9fc9c032d660435155361ffebd5e

      SHA512

      420f2676b52c2a331ebc9f2fc3a761a0429f421970646e8c968cc9b94fc1558d4bf614f42278a317826fdc78b51647ce3b430e135879b5ee2da471831d46d5e4

    • C:\Users\Admin\AppData\Local\Temp\uhgkdyfg\uhgkdyfg.cmdline

      Filesize

      273B

      MD5

      d22863aaf5ad31c403bac486a6e6c5ab

      SHA1

      b7922a86bd35eda8e91a8ca715faa40ac3afad8a

      SHA256

      fb4a1044389b7afdbbba77c6fc2360aa540b8ab510ee29ed320e5d91ab86dddb

      SHA512

      18f93035760745037f010597d166bd8ff7a006f0caade441889a9c3f9ef157c703647eedfe8cbe24cc97e1427104a814bfa56c4c921f7e1f7ac58db68e16ebb9

    • C:\Users\Admin\AppData\Local\Temp\vbc3302DD3A9AEF4D5A888576C7D0AE9C71.TMP

      Filesize

      1KB

      MD5

      c76960012f2515a536796f8cf7bd7419

      SHA1

      0f850e5b1239f7bb43a5713a87a5d506910b798a

      SHA256

      12f2ef52f8b696784df84eebd2e01e233fef4b1e6a04a7f65006f020cbd7e8cd

      SHA512

      84cb375599de6ed03788220ab210bb48715f0d4f097f4487ce5bd2c0a7a3a5baeadad9e6b2968473b76a3c54f9cb781027ce99ee3d5660330bd3f37e9fc168a1

    • memory/1016-24-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1016-25-0x0000000000C70000-0x0000000000C7A000-memory.dmp

      Filesize

      40KB

    • memory/1016-27-0x0000000005B90000-0x0000000006134000-memory.dmp

      Filesize

      5.6MB

    • memory/1016-28-0x0000000005680000-0x0000000005712000-memory.dmp

      Filesize

      584KB

    • memory/1016-30-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4396-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

      Filesize

      4KB

    • memory/4396-8-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4396-2-0x0000000004A80000-0x0000000004B1C000-memory.dmp

      Filesize

      624KB

    • memory/4396-1-0x0000000000120000-0x000000000012A000-memory.dmp

      Filesize

      40KB

    • memory/4396-26-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB