Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 21:05
Static task
static1
Behavioral task
behavioral1
Sample
0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe
-
Size
58KB
-
MD5
879934d4df1f64c56bdb44928f18c900
-
SHA1
3558a0a9aaf0b20cf42edc450fb44f5b2c58ec43
-
SHA256
0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e
-
SHA512
f95c7d180c4ce9f85a21f1bf6f7e0433af56c9f413e6cb30928446a48dfc151769ef73627a1e8620a678dba6aeb52aa59d3a8cc871aac5253341f4a12b75e862
-
SSDEEP
1536:l7X2lykmUO2drIYfdQ3W8PTZEd4Ejf/kE/Q6mhnDxMmKy5:VXmykmU9If3h1O4Eb/eOE
Malware Config
Extracted
urelas
112.175.88.208
112.175.88.207
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation 0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
huter.exepid process 912 huter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exedescription pid process target process PID 680 wrote to memory of 912 680 0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe huter.exe PID 680 wrote to memory of 912 680 0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe huter.exe PID 680 wrote to memory of 912 680 0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe huter.exe PID 680 wrote to memory of 3852 680 0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe cmd.exe PID 680 wrote to memory of 3852 680 0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe cmd.exe PID 680 wrote to memory of 3852 680 0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0e57c2b5fe2fe6b66bece7fdc1211503a1cd8b0ccddbf211e558050b6f8f796e_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD514ab4579b6f3a97ff1099d4591f166c1
SHA19379aa65d3bfd4f819f06417b90dbc9ec7bc1354
SHA2561bf9ad4eb9a6ec73fdd5bd94de5ffca1d94a48707f5a2818d5fcd68033cf1101
SHA512a6342bf2172f65e4541230f91249c77e5ef2e558acaa91caec520fc4b2ca2f57a4f687c62227a7d20b0264b41bd88f6ad3d38d23bcf571165693b861232c4ac2
-
C:\Users\Admin\AppData\Local\Temp\huter.exeFilesize
58KB
MD5050419f4088c83c18a7ad362e1374aef
SHA18cadc681c4ac00a0ca53382b5d3582a61e3d1865
SHA2564c8c6c8b5b31b92017b92dc090578d046e024fed8af82466df92ab74fa8b82a7
SHA512d7f5a087cc8f680e2c7a10a816b4030f1324b2f84881b9fa7970220d18e29d9aef2337f4a763130de67054f3f4fb1fceb114e60ef91772b8bdb6552d95d4a967
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
368B
MD52eb9c578f9c05de73daaa7e84189cfa3
SHA1988f07cd14dc62af9743a3d1d807c15050f8b74f
SHA25614edfefedd266ad06fe2f7428eea4369aeb515e840c18763cebdc9433e672014
SHA512ff8c5fadf3abc0755751cf5c9b58dd9b69ad5f522f6cd656d54c382bc9ab0b1792656babbfe4c7c94fc8b46cfe93321272c8f4ebc9a320d4aafaee6da10dae90
-
memory/680-0-0x0000000000B70000-0x0000000000BA7000-memory.dmpFilesize
220KB
-
memory/680-15-0x0000000000B70000-0x0000000000BA7000-memory.dmpFilesize
220KB
-
memory/912-13-0x0000000000680000-0x00000000006B7000-memory.dmpFilesize
220KB
-
memory/912-18-0x0000000000680000-0x00000000006B7000-memory.dmpFilesize
220KB
-
memory/912-20-0x0000000000680000-0x00000000006B7000-memory.dmpFilesize
220KB
-
memory/912-26-0x0000000000680000-0x00000000006B7000-memory.dmpFilesize
220KB