Analysis
-
max time kernel
89s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 22:38
Behavioral task
behavioral1
Sample
5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe
-
Size
56KB
-
MD5
5f23c5fe29d4e99c992b6c5bb69799e0
-
SHA1
77498d7bcd1a2292f5bbde0ccf6646c406da2cd8
-
SHA256
270b2bb94948fc12d73c9cb6766a4b9920e22172e8400afc13d5db4da533e621
-
SHA512
75e090a5a905e946357e87eeb9ba74a770b7b61201ce07cd38af6a9f80ec1c09fee88fb297edb555cfacefe845350d72f427d408fd3fa90b63a66d413b99ff99
-
SSDEEP
1536:6W82C0Db1edMckBI1kmJAhTPY6pnouy8W:6n25DbaMySmJAhbvoutW
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2012 biudfw.exe -
Processes:
resource yara_rule behavioral2/memory/2120-0-0x0000000000CE0000-0x0000000000D0C000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\biudfw.exe upx behavioral2/memory/2012-12-0x0000000000330000-0x000000000035C000-memory.dmp upx behavioral2/memory/2120-15-0x0000000000CE0000-0x0000000000D0C000-memory.dmp upx behavioral2/memory/2012-18-0x0000000000330000-0x000000000035C000-memory.dmp upx behavioral2/memory/2012-20-0x0000000000330000-0x000000000035C000-memory.dmp upx behavioral2/memory/2012-27-0x0000000000330000-0x000000000035C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exedescription pid process target process PID 2120 wrote to memory of 2012 2120 5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe biudfw.exe PID 2120 wrote to memory of 2012 2120 5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe biudfw.exe PID 2120 wrote to memory of 2012 2120 5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe biudfw.exe PID 2120 wrote to memory of 1672 2120 5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 1672 2120 5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe cmd.exe PID 2120 wrote to memory of 1672 2120 5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:2012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:1672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5aa69678950aeb5442ae7937687d4393a
SHA169e3cb0644af48b83a1562eb09020383812b8966
SHA256e996e8e08852163b9c06ea3d3c47b56b838e7cd636d2ba2f4e97d984beed9b28
SHA512df2d86c48a0eead97215cc20474422c61e9f5ee8840804cab54eedabe45f1255a8c90a4a5caa56b2bbd3c31674b205c6bbbbca062227872f926b0fcee96dda65
-
Filesize
512B
MD5b4a86880004da8726288d7ec954885a8
SHA11bab1cfbdc2c540246210bc7852f8fe7e8357b31
SHA256c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46
SHA51222758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4
-
Filesize
304B
MD53f149920e4d09e8d64558827835cc9af
SHA1dea72bc644c12b27fbfb3236e74b009b0ad7269b
SHA256f3b5c3f2d164ea317e03dd92a8f2c32ead90dd248bfa4b59cdbebabc6040bb8b
SHA5122f41fbdf2c99834d10fc93b9e2158bccf88997697c8a4154dbe56262ba4ad007668dcc210fbb73aee899e95c2c1bd628c0b9ed9e0e7787cfc03906b4199f9f77