e870e756ca1b1655d2eb872db300de857f4c08c52f32e9e6898dbdb004d8402f

Analysis

max time kernel
57s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
75d3548a275b96a022c814e3f7a9ae50_NeikiAnalytics.exe
Size 43KB
Sample240613-mwfemszbml
SHA256 e870e756ca1b1655d2eb872db300de857f4c08c52f32e9e6898dbdb004d8402f
MD5 75d3548a275b96a022c814e3f7a9ae50
SHA1 2ddecb7f9a49da9c2382cd1de3fb6cc171c1e71b
SHA512 3a152db013f5ebb8890a4872f02c50db8b7a1b256057e3c57169666a3bf923ff082605b1f7171caeb14abd3385acb443d10252c28bff09c3f09ea394fd143aae
SSDEEP 768:pGbu1hJSyC8MmGkqEPGsr+ZFbAacqvhM1s:cbu/cyC8MHzE+sr+XA6ws
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	75d3548a275b96a022c814e3f7a9ae50_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3336	lssad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 3336	836	75d3548a275b96a022c814e3f7a9ae50_NeikiAnalytics.exe	83
PID 836 wrote to memory of 3336	836	75d3548a275b96a022c814e3f7a9ae50_NeikiAnalytics.exe	83
PID 836 wrote to memory of 3336	836	75d3548a275b96a022c814e3f7a9ae50_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\75d3548a275b96a022c814e3f7a9ae50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\75d3548a275b96a022c814e3f7a9ae50_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\lssad.exe
  "C:\Users\Admin\AppData\Local\Temp\lssad.exe"
  2⤵
  - Executes dropped EXE
  PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lssad.exe

Path C:\Users\Admin\AppData\Local\Temp\lssad.exe
Size 43KB
SHA256 49f3b3b3e3ce1ced2290b23fb52411b1b07dc0c2e57f59dd4ffc7a92446e0233
MD5 fc6c98ab8b439ecbf937c525127223b9
SHA1 3e1ec6df4e566c2bc4fe3692e1f038e4103e9e1d
SHA512 a2e80a956da21e23e867a84fae932b7868d5d526afca6a21de1249b46171b42f1ebac5a5260dc0ff141c6f0c5933e817307d92fff7e6cd4d809ada23f24e4c0b
SSDEEP 768:pGbu1hJSyC8MmGkqEPGsr+ZFbAacqvhM1S:cbu/cyC8MHzE+sr+XA6wS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/836-1-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

Download

memory/3336-9-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

Download

memory/3336-10-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads