41173e0336b0218fd0939ac0a09165ce94b4eb6ed4174ace3c8f85c92a6a94b1

Analysis

max time kernel
142s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe
Size 2.7MB
Sample240613-pgkrxsybla
SHA256 41173e0336b0218fd0939ac0a09165ce94b4eb6ed4174ace3c8f85c92a6a94b1
MD5 7b8a4806503f1957804e2186715d1c50
SHA1 68da736f0b3faf5b148e540cad5fd4dc4bd8f6d4
SHA512 42eda461a851c4e5dcacf8b7b30339b48187654e3d624283e6b2855f9fb2d4dde6a1fc202d97e7c320cda7e4705fa4dd56b155628ac21558cebaf4057f768ea5
SSDEEP 49152:0BuZrEU81lk324MPYC6v8/dRXm5nUTsN5pu7nis1KN7A7s+pbKIy029s4C1eH97:KkLAl74YYC6v8/XyrFInis1KN7AY+pTo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp

Executes dropped EXE 4 IoCs

pid	Process
1336	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
2156	663689829b238_pe.exe
1996	663689829b238_pe.tmp

Loads dropped DLL 3 IoCs

pid	Process
1336	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
1996	663689829b238_pe.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Rufus.exe\is-1UI31.tmp	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
File opened for modification	C:\Program Files (x86)\Rufus.exe\unins000.dat	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
File created	C:\Program Files (x86)\Rufus.exe\unins000.dat	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1336	576	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe	81
PID 576 wrote to memory of 1336	576	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe	81
PID 576 wrote to memory of 1336	576	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe	81
PID 1336 wrote to memory of 4648	1336	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp	84
PID 1336 wrote to memory of 4648	1336	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp	84
PID 1336 wrote to memory of 4648	1336	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp	84
PID 4648 wrote to memory of 3028	4648	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe	85
PID 4648 wrote to memory of 3028	4648	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe	85
PID 4648 wrote to memory of 3028	4648	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe	85
PID 3028 wrote to memory of 2156	3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp	87
PID 3028 wrote to memory of 2156	3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp	87
PID 3028 wrote to memory of 2156	3028	7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp	87
PID 2156 wrote to memory of 1996	2156	663689829b238_pe.exe	88
PID 2156 wrote to memory of 1996	2156	663689829b238_pe.exe	88
PID 2156 wrote to memory of 1996	2156	663689829b238_pe.exe	88

C:\Users\Admin\AppData\Local\Temp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\is-HPLHN.tmp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HPLHN.tmp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp" /SL5="$601D6,1969499,832512,C:\Users\Admin\AppData\Local\Temp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe" /SILENT /PASSWORD=84773907
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\is-J9IAI.tmp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-J9IAI.tmp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp" /SL5="$701D6,1969499,832512,C:\Users\Admin\AppData\Local\Temp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.exe" /SILENT /PASSWORD=84773907
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\is-EOQFH.tmp\663689829b238_pe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-EOQFH.tmp\663689829b238_pe.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\is-G3QC1.tmp\663689829b238_pe.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G3QC1.tmp\663689829b238_pe.tmp" /SL5="$D002C,922170,832512,C:\Users\Admin\AppData\Local\Temp\is-EOQFH.tmp\663689829b238_pe.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

663689829b238_pe.exe

Path C:\Users\Admin\AppData\Local\Temp\is-EOQFH.tmp\663689829b238_pe.exe
Size 1.7MB
SHA256 56f5e4a8271315dc41d7a5ef2ebb0e969a164898863dc7897f1360f83ffa4c2c
MD5 e17ec5ff8821d1c678dffdc5c3accf84
SHA1 ab9635a192f8ebea185a04393057346507904217
SHA512 5b054d02492ac2d27e3406b872e3b51382e1e134c6335703749bdde16fece7bcf68ebbdd948f15edc52410797c7d1fc22ebe46bb9b6fe62ffbe05627b2d9a4cc
SSDEEP 24576:s7FUDowAyrTVE3U5F/fGqKPrKic6QL3E2vVsjECUAQT45deRV9Ra:sBuZrEUK9rKIy029s4C1eH9w
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-FH00P.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

663689829b238_pe.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G3QC1.tmp\663689829b238_pe.tmp
Size 3.1MB
SHA256 75db576fe097e0844e64ce6126df6cda71ff3af759e25fef70811d2d4eb5c797
MD5 6770a35390014680c184e0dba7e0e255
SHA1 a674aa09ad0f39b1690f9ec9cec362129ba3ea66
SHA512 3aa7a8f4ae630ca42c6d03faaa944f125fcee90488ce6689145cc520f03f6860afa7c4f88ded0af2f766e5de9ffa7f4303b75d8a5440a8068eb7ff3a824aafa7
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HPLHN.tmp\7b8a4806503f1957804e2186715d1c50_NeikiAnalytics.tmp
Size 3.1MB
SHA256 9237114ad9342767102d428ec948ba92c475e3ece73d6590e134bffcf08f253d
MD5 c3f4c97160c54234646ca1583014426f
SHA1 7bbf58b9cab9410344618a2eebf8d2c69901a723
SHA512 944698acb6f95e76ac8c34d0a7b8cd58155554de345a322ff9faa1d93e71b0e587ffbadf852e4f7b7b4a6d766a85140e9cfc366d0c2ac9078fa28254dd1b5972
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-KKG5B.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/576-19-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/576-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/576-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1336-17-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/1336-6-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/1996-50-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2156-49-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2156-36-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/3028-27-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/3028-48-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/4648-47-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4648-15-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4648-13-0x0000000000400000-0x00000000004D8000-memory.dmp

Download