edf76d25f16d33a072d94bfe05b070cccf86ac34b48a58edb5fc3730d85d917e

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8307f903507a3ec57052bc6689b19c40_NeikiAnalytics.exe
Size 672KB
Sample240613-yxtt7starj
SHA256 edf76d25f16d33a072d94bfe05b070cccf86ac34b48a58edb5fc3730d85d917e
MD5 8307f903507a3ec57052bc6689b19c40
SHA1 7f5a82e7212bf4e66984f5e1b21b39543688fdeb
SHA512 59a9e21a08f5c92cfecc5881d847698929b623306da36dbf07d9b28c25bfb7528e089bd51a9ec764e34ae5150e2d2abb766a63e751c7c7f562ef46b8ddb67a61
SSDEEP 12288:m7IRWDvFa+nhmuF3Y0scJeDuUlXMoNDp15FEaNg:m7GUo+F3YlcipFtEI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	8307f903507a3ec57052bc6689b19c40_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1872	SqlExpressChk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1872	4692	8307f903507a3ec57052bc6689b19c40_NeikiAnalytics.exe	89
PID 4692 wrote to memory of 1872	4692	8307f903507a3ec57052bc6689b19c40_NeikiAnalytics.exe	89
PID 4692 wrote to memory of 1872	4692	8307f903507a3ec57052bc6689b19c40_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\8307f903507a3ec57052bc6689b19c40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8307f903507a3ec57052bc6689b19c40_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\VSDDE79.tmp\SqlExpress2008\SqlExpressChk.exe
  "C:\Users\Admin\AppData\Local\Temp\VSDDE79.tmp\SqlExpress2008\SqlExpressChk.exe" 10.0.1600 1033
  2⤵
  - Executes dropped EXE
  PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4040,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SqlExpressChk.exe

Path C:\Users\Admin\AppData\Local\Temp\VSDDE79.tmp\SqlExpress2008\SqlExpressChk.exe
Size 108KB
SHA256 f4ab3f247ed2302367a6163f0269b3bf2b143848c3401e88aa2031ae23c8fe26
MD5 3a77ddc12bb01b6b48fc60ac4e8c46aa
SHA1 76c95f6d9b23b19241b95df7543d7d465ed553c8
SHA512 9fd6be9a9ee8188947f854751d5fa5ca3505fcf44d92a881418ea5471dfe468a93cd88ac3dac4a44691411e331b76808cf9fc9cf846f1b696961ab7422083a81
SSDEEP 1536:xUVj3JvQVhhLn+gFwMz8Z8BTouSBkWJznW29XoEBEQfaze5/QgH0Lb19rHUOF:xU+VnTFwM5FSbW294E2Ri5/TH0X19oY
MD5 SHA1 SHA512 SSDEEP

Submit Download