Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 07:14
General
- Target 6880e8595bc7325c63956b65130fd150_NeikiAnalytics.exe
- Size 1.6MB
- Sample240613-h2phaasgrk
- SHA256 becd9a6b149404c4343d6fb392bc05495077546da7d486d20a2fb4dd4c20c0d7
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6880e8595bc7325c63956b65130fd150_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6880e8595bc7325c63956b65130fd150_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6880e8595bc7325c63956b65130fd150_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
520629489.tmp
6880e8595bc7325c63956b65130fd150_NeikiAnalytics.doc
memory/3544-29-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-33-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-32-0x00007FFBA07ED000-0x00007FFBA07EE000-memory.dmp
memory/3544-34-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-31-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-30-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-35-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-37-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-40-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-39-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-38-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-41-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-36-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-43-0x00007FFB5E600000-0x00007FFB5E610000-memory.dmp
memory/3544-42-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-44-0x00007FFB5E600000-0x00007FFB5E610000-memory.dmp
memory/3544-55-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp
memory/3544-78-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-79-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-80-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-77-0x00007FFB607D0000-0x00007FFB607E0000-memory.dmp
memory/3544-81-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp