e72b0a8c462001488696fa991a940aae2c07faac4ad3cb7cc8aca6bf63d9f0f3

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe
Size 12KB
Sample240613-znd8tstemj
SHA256 e72b0a8c462001488696fa991a940aae2c07faac4ad3cb7cc8aca6bf63d9f0f3
MD5 860f160b01daa2a91cf097dbf19f3160
SHA1 28e1c00e3dc2ea6f3998fcae983537bce5db71ca
SHA512 9f32c42591e3239c72bd60113f67d3de737ffc46dfa26e62a04ced2c5a28537af39543779af1c2b50d629f691a374aefd524b45da952d4a7855c36dff6e0d557
SSDEEP 384:NL7li/2zbq2DcEQvdhcJKLTp/NK9xaTd:d/M/Q9cTd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
4028	tmpFFFC.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4028	tmpFFFC.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	332	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 1572	332	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe	92
PID 332 wrote to memory of 1572	332	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe	92
PID 332 wrote to memory of 1572	332	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe	92
PID 1572 wrote to memory of 3120	1572	vbc.exe	94
PID 1572 wrote to memory of 3120	1572	vbc.exe	94
PID 1572 wrote to memory of 3120	1572	vbc.exe	94
PID 332 wrote to memory of 4028	332	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe	95
PID 332 wrote to memory of 4028	332	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe	95
PID 332 wrote to memory of 4028	332	860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe	95

C:\Users\Admin\AppData\Local\Temp\860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gycjhiy5\gycjhiy5.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B0D232A828A47A1A48129A979C3DF8.TMP"
    3⤵
    PID:3120
- C:\Users\Admin\AppData\Local\Temp\tmpFFFC.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpFFFC.tmp.exe" C:\Users\Admin\AppData\Local\Temp\860f160b01daa2a91cf097dbf19f3160_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 275436a7808270e90c3253e505c2e365b42b33cd0ceb3e1e343b23e5488889cf
MD5 d139fc3ba51150f88971e459f3546276
SHA1 22b7a58a21dbe48e7140f4fd3820e1f4ec0f5b82
SHA512 b5f6fba8ad4b05ac025ae7a4fe96df6366cc3b5bdb87eafbde27148fcab538087c4b60ba1df6dfcfe6ab0e6957525f86f9952d09ecdbacf3a1eb019e3a27027c
MD5 SHA1 SHA512

Submit Download

RES7CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7CB.tmp
Size 1KB
SHA256 3d20f3889ea6adc82338f1636d32ef99c6d6ce7a2be28b283b90a5d0e3f033d7
MD5 4d1ca4ad2613c1c10f9a50269e030fe6
SHA1 dbcaf25ff291c86f21f083518188b76470b8ad84
SHA512 eb906d460797a5b9c922bf2fd819ca97ada17d0bb15bfd4f194ae3f3a0cb4599671a65975214618845cda6c43a03995583be63904a655be9df9baa7a19c9450d
MD5 SHA1 SHA512

Submit Download

gycjhiy5.0.vb

Path C:\Users\Admin\AppData\Local\Temp\gycjhiy5\gycjhiy5.0.vb
Size 2KB
SHA256 24496305a5dcad6bfcc386b797dd511f689afbe5b917645634faa3ffd271645f
MD5 5161d577cd66c589432c80d5f12c0f83
SHA1 ae3980acdd871284dd15c57b04fb1818707a9a25
SHA512 490d1853517c5bd4a810d02f70f2b9dd20e5f96dfbb5dcd76f6b9c9f631a25248e34638ab688dbab203e8406169fcc24a44136c702b1be96dc9d84e2ef0dcde6
MD5 SHA1 SHA512

Submit Download

gycjhiy5.cmdline

Path C:\Users\Admin\AppData\Local\Temp\gycjhiy5\gycjhiy5.cmdline
Size 273B
SHA256 1d630db7a9e60517d83eabf54d2c08ffbec3a6a2123e7d2ac6556f3255a3777f
MD5 b73638c94cab569a8fbb4c4a2883ae99
SHA1 cdc0f7966a8a7950e99bf069339226df156e631c
SHA512 23180187118ba53468aa55464a71679266472c1058fc47cefb449f1a2145fcac613c5627bcd63fd6829e13a503602eccae0177dcf535741d5fdc41b0a2cd3396
MD5 SHA1 SHA512

Submit Download

tmpFFFC.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpFFFC.tmp.exe
Size 12KB
SHA256 93b0e3c786c7c0653d0d55aa062d339d53916e98b669e7d9e621819d30d482e2
MD5 73b092b2a242a239b09b5f5824b7b10c
SHA1 34822bf4c5191ba57aad3f379b7171183e8ad2fd
SHA512 7e3a240072a32b545046346ddc08b1343c01afc55695d675ddd0d52c77797f33c7cd9e06afb14d97aee1dd0883ca9ec006f6014a14c14a0290c2ac8600485e8c
SSDEEP 384:mL7li/2zHq2DcEQvdfcJKLTp/NK9xa8X:ATMZQ9c8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc4B0D232A828A47A1A48129A979C3DF8.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4B0D232A828A47A1A48129A979C3DF8.TMP
Size 1KB
SHA256 45968ad2538c1608b1fb5b621b16fbab0dba503734f9fe56654039fe55e652b1
MD5 67befdf320a50be9c6695ab203bf0d1a
SHA1 63e8809eefff784422dceb2af62983c4aa4890e3
SHA512 febe8f8d6a21ff9f3a37c1ee776ea48fc8c8bdb72a824d89ec89a1b0acdb5cc261549df0f3703dca2110e0b6449907fd3a85af04139ab72de7bf212b4d8a93e1
MD5 SHA1 SHA512

Submit Download

memory/332-0-0x0000000074F0E000-0x0000000074F0F000-memory.dmp

Download

memory/332-7-0x0000000074F00000-0x00000000756B0000-memory.dmp

Download

memory/332-2-0x00000000058F0000-0x000000000598C000-memory.dmp

Download

memory/332-1-0x0000000000F50000-0x0000000000F5A000-memory.dmp

Download

memory/332-26-0x0000000074F00000-0x00000000756B0000-memory.dmp

Download

memory/4028-24-0x00000000008C0000-0x00000000008CA000-memory.dmp

Download

memory/4028-25-0x0000000074F00000-0x00000000756B0000-memory.dmp

Download

memory/4028-27-0x00000000057D0000-0x0000000005D74000-memory.dmp

Download

memory/4028-28-0x0000000005220000-0x00000000052B2000-memory.dmp

Download

memory/4028-30-0x0000000074F00000-0x00000000756B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads