0bb640fbd0089199e66fdfbb0887015ed04255dcadefcb43973788d77b553a41

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7404011350a2f8edfa892cc50282b870_NeikiAnalytics.exe
Size 41KB
Sample240613-mfa5zsvclb
SHA256 0bb640fbd0089199e66fdfbb0887015ed04255dcadefcb43973788d77b553a41
MD5 7404011350a2f8edfa892cc50282b870
SHA1 c27ba6c7768cd3c36648cc64b0ffe37ab9acc16b
SHA512 9b13a87d41e17038eac3ee89316de486e82d60793dd5a2bed95bf95757c19353e8609a89af75e5783b77ee496c3f277696ca9ad61bd166eda4a284b969446ef7
SSDEEP 768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3HwnC/:bA6YcA/X6G0W143Qg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7404011350a2f8edfa892cc50282b870_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
412	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 412	4832	7404011350a2f8edfa892cc50282b870_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 412	4832	7404011350a2f8edfa892cc50282b870_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 412	4832	7404011350a2f8edfa892cc50282b870_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\7404011350a2f8edfa892cc50282b870_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7404011350a2f8edfa892cc50282b870_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hasfj.exe

Path C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Size 41KB
SHA256 8fea4d00b3b9f93b3d31dc4d2c2f9bf1295ca453369df8f62069ca26acbfa2df
MD5 e7a127eb82c0476f16b43fa34975caef
SHA1 0fa6ca5d2ea4676c271c94b7083ee0f0628d2bde
SHA512 c48a721a3bb6df79026ac36a263afad12f536393a149466d1af82825a2558317c390bf0ff4be068484b4e87e8e50286fdf9eaed3db459820a2fd637437b86dc8
SSDEEP 768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3HwnC1:bA6YcA/X6G0W143Qu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-17-0x0000000002090000-0x0000000002096000-memory.dmp

Download

memory/412-18-0x0000000003010000-0x0000000003016000-memory.dmp

Download

memory/4832-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Download

memory/4832-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Download

memory/4832-2-0x0000000003150000-0x0000000003156000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads