Malware Analysis Report

2025-01-18 01:35

Sample ID 240613-jz7fravakq
Target 6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe
SHA256 9e525302bf5fd351ec80a3310d5efc03de7922fcc72e14a6f86c16add0eeb23e
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

9e525302bf5fd351ec80a3310d5efc03de7922fcc72e14a6f86c16add0eeb23e

Threat Level: Shows suspicious behavior

The file 6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Deletes itself

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Uses the VBS compiler for execution

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 08:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 08:07

Reported

2024-06-13 08:10

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1676 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1676 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1676 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1676 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 3016 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3016 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3016 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3016 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1676 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe
PID 1676 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe
PID 1676 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe
PID 1676 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yei2cip5\yei2cip5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2443.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3F48310664D942E3B7FFFC41A19B8D8.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe

Network

N/A

Files

memory/1676-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

memory/1676-1-0x0000000000050000-0x000000000005A000-memory.dmp

memory/1676-7-0x0000000074BA0000-0x000000007528E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yei2cip5\yei2cip5.cmdline

MD5 2fd1808e23b51cc8b3950e82334dc393
SHA1 1a1b7977dc906906039e13807a2638359f7aa2fd
SHA256 4d52de2f8d3e2c2da85ce44dda2675ce65173f29b82993a6fedd56ccb5d45b5b
SHA512 3623cbc4c3e80d467e0f40631ec3ee2640d25d435e6936a8c6f0326f99a5a43fe5d3ce4cf032b5911284d715f26c57d08cc9c6a99cb3b6298dc2af73267e8656

C:\Users\Admin\AppData\Local\Temp\yei2cip5\yei2cip5.0.vb

MD5 c5b05cb7178f58d8374cde55531d4644
SHA1 4750680ad55c5d640c78fa597c14c6ef228acb35
SHA256 cd825fa6c0483642910555b7b401174d5371455e8789b7b335a367d849a4d722
SHA512 aa9a3cb2ff20bf970208ded15c4bb0606ffa440597d481db22370adbf67fe48487be3153e2f4c3e96cb8b9b2102ecd3a2c3c8d5435e8f7a4ba09d2d1f5b28cee

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 17e07464235c6ebbb59525a2a85cd6ea
SHA1 e436e92f3ca6446ae6d4ebddee3815193a29b83b
SHA256 3c4a90e4d63b143a282f6b7fb9c10c88de26e7489a1068684dab432e102f0317
SHA512 967a084924542612629373db1942212bce497f20510fc625f775e6dc9eaf13b696a42264d183dbe20d4878961058455139c43c6b2e3fc0905cd6ebdd3ab7fb3d

C:\Users\Admin\AppData\Local\Temp\vbc3F48310664D942E3B7FFFC41A19B8D8.TMP

MD5 4021cc051d3cfa2e2be316e13d15e1ae
SHA1 bcfc8b06db3627c9da455919a6f9504513f07c24
SHA256 9fc0abc7e7d0e861eef2e3da89093812b3e48a308dbdbd14803ea98119b7c068
SHA512 894d12bca5a0faf9aab04450a59aa2b394cb851cb11743f4524946778a2133342aa1c437a50ecb730437dfee03d2ab9ce229fcfb3b1992a5dd641777259e11a1

C:\Users\Admin\AppData\Local\Temp\RES2443.tmp

MD5 128c2e7cf9fda979eefc7c13cfd152b2
SHA1 045239ae0744ce215f460811e9e32ce1b5da6a67
SHA256 c7520470b66341de8a6f836e5c2d0e6957c037244e47b56316b64f4015a1b542
SHA512 9a3d53534fe4901050eee82a5417ac0e6f12d31856182f8a9e4c5ead181978026d7392b915a6571aec077821fde69c5259999cb39464481a0afdb06a41e87af6

C:\Users\Admin\AppData\Local\Temp\tmp22AE.tmp.exe

MD5 cdb131324eb873ee9922930b22055611
SHA1 3d557347e4c2c161b3b65412446c9b129114b45e
SHA256 36096280b7225ee8b1f52a3e857bee64df0290ccc8430187f662d66ae197896d
SHA512 ff99414da2e06e7947be1e1ad6090febc196a6d483be90a3ab01637019aea34754194961e0ab3c0ac126207a459499225f97a6b0d7d46258c3baf34d12325f77

memory/1676-23-0x0000000074BA0000-0x000000007528E000-memory.dmp

memory/2548-24-0x00000000011E0000-0x00000000011EA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 08:07

Reported

2024-06-13 08:10

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3420 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 3420 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 3420 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 3564 wrote to memory of 4612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3564 wrote to memory of 4612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3564 wrote to memory of 4612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3420 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe
PID 3420 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe
PID 3420 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ojmr4qwa\ojmr4qwa.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF04B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc217F33C59CC440B192CC9A2C6B28357.TMP"

C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6b9327e7e52a3039d5e25a51633935e0_NeikiAnalytics.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.204.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

memory/3420-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

memory/3420-1-0x00000000008D0000-0x00000000008DA000-memory.dmp

memory/3420-2-0x0000000005250000-0x00000000052EC000-memory.dmp

memory/3420-7-0x00000000744E0000-0x0000000074C90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ojmr4qwa\ojmr4qwa.cmdline

MD5 c0a4d0034d8c6bdfaa9ffd96681ea2cd
SHA1 e7465848447d015710be39beea32263a51787f8e
SHA256 ce0520559e9fd65a0126f482d46c8661296819d2e8348377dd8876d3ea3c2daa
SHA512 df42030e7f10c88b0b8ff07545cab9a953a5015f8dc26c83a8962b991268fa461f558d4dc429751d0c3b78146ef3a10c70fd783e4f77ca166160071c6aba74c4

C:\Users\Admin\AppData\Local\Temp\ojmr4qwa\ojmr4qwa.0.vb

MD5 bfe9294bd07da41c58d222d0d49ed4ec
SHA1 9e3c68aeb4e2db5e69fb9feb70b1d2a2be2cfe2b
SHA256 86f8401ad097f33f6ccc8a4127c63c34718a6b540f0f48978791fd920a9d0cfb
SHA512 4769b77ed8046ca02f53f83c68e3d1e16f963589a229e8ee40656eeeb8b29030f3c8d70993aefec39061c385f23c1657a692a51dca4eb353d7a5a4b371c69bb6

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 0bde1261c5367c14bc41d5a3b091c48a
SHA1 b610b36b8e1fa801564a83941c2c00ce5816ed77
SHA256 7ad614b7a34933e033ca6a36cf09b8b9940c0d212ca584408c957e6de152735f
SHA512 b4b4a66f59aaa32052e6479850fa791f61b43ba6938c31ca3267fd1619199139c8670dffabd5c6e291ba8cd22fa8f7770c3ed37f8451324605f019afe6272073

C:\Users\Admin\AppData\Local\Temp\vbc217F33C59CC440B192CC9A2C6B28357.TMP

MD5 53399e5b2d0df997c85bfb02a4db9b35
SHA1 2a4585779f196b4981c87015bb0a834c2e8256f8
SHA256 3ff8b65b1b9f36e7d50cab3a14f0db97c4417bd69978995353a7cfe719b886a3
SHA512 78a40b9d46b180b72f33c1ed2c48ecd99de5ca96ec540abda54e33110c7ac088247c2517c7b9ac8c7d73d2d168e8c0e885ae5b5617d9c6616face9dba086fde8

C:\Users\Admin\AppData\Local\Temp\RESF04B.tmp

MD5 9cee1c2f9850f57e57078c365b39637e
SHA1 fbdf261b46a469e72070f68026628f14bed43057
SHA256 dc415c393a9d85c47f18f8dc2264a570d5f7630e47d96a6ab267969d6a376445
SHA512 efd527d0f76615c31ab219d186c9e3d3571254a2324971451298e60d4060f1dc87d1c6ec1bc6cae3a36b1b20c2e9d53ce26d083da8b878c82a18081dcd3f1f54

C:\Users\Admin\AppData\Local\Temp\tmpE8BB.tmp.exe

MD5 c78a22e2a2492bdc9cf858375744f05d
SHA1 5ea0a3aff6c35803a6441ef79395f955c4eaf523
SHA256 eb784822f9901bff37f4b4a930070ddb83bbc2ffeb6e0eff75dda014e6b42ec0
SHA512 0badc3904042e9f99dc4115a27652d5c51000b643f03e68aedfaebe1e2db0e8ad197056fc273044c80d44dc69cad68892204a605358ae77fa5cf1f9c185e2cc5

memory/4112-24-0x0000000000020000-0x000000000002A000-memory.dmp

memory/4112-25-0x00000000744E0000-0x0000000074C90000-memory.dmp

memory/3420-26-0x00000000744E0000-0x0000000074C90000-memory.dmp

memory/4112-27-0x0000000004F90000-0x0000000005534000-memory.dmp

memory/4112-28-0x00000000049E0000-0x0000000004A72000-memory.dmp

memory/4112-30-0x00000000744E0000-0x0000000074C90000-memory.dmp