31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93_NeikiAnalytics.exe
Size

45KB
MD5

874e0e5124d00e8764072c2c03a403f0
SHA1

072490946f48a29f28c28b60e12cdf9992329ded
SHA256

31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93
SHA512

7b8a85765ee6d6904155d965593397f57b2177145301c0875596d2ca8e3bb0032a451e30b7f9dc4a0a3b7208ec0ecb90fa162232f1d664868004988e7c6c56e4
SSDEEP

192:GrITdb2X2VFmfjNIGmMTPUEN7jIZSnDJLVwqnkqU/CDola1:yIT4BjKGmMztNvIZSD/wHqUWol2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2856	hcbnaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 2856	4540	31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93_NeikiAnalytics.exe	90
PID 4540 wrote to memory of 2856	4540	31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93_NeikiAnalytics.exe	90
PID 4540 wrote to memory of 2856	4540	31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\31fcb0857ef865ebdc29384bc739091549bf3d827e0938befce0cb651411fe93_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
  2⤵
  - Executes dropped EXE
  PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe

Filesize
46KB

MD5
48f62f2db5df1b5141ed868a438e8122

SHA1
cff200359b0c3b4f4bbd58f83df72398f3aa6338

SHA256
9f9bd86293636f2657e614d4d3528a1a5dd685204fb170ab7fff87f0af68cab8

SHA512
90d80b3297659996de03d1b5770df85cf455ea1339fa26bbd9042182ff9d31acb78c5c1f2f6f1ba4639f70a8c2fbeea8da12e7624251ec438fc6ad5b3ea334a6

Download Submit