6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df

General

Target

6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe
Size

370KB
MD5

1532e9fd97ee6339d8bcc668457959e0
SHA1

d97a7ca7e036930786f5bd7df43148cb1e4018c1
SHA256

6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df
SHA512

9999dbac2b93d38c413dbe6e43fc9104d9b463ea33d6046615a2c80a81c1fb173b43ae7a72bb432c440adece2a5da41f62119e61dbf537d34910752fb01c65a7
SSDEEP

6144:CuJkl8DV12C28tLN2/FkCOfHVm0fMaHftvCGCBhDOHjTPmXHk62pii:CzGL2C2aZ2/F1WHHUaveOHjTei

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.execoafq.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	coafq.exe

Executes dropped EXE 2 IoCs

Processes:

coafq.exegojab.exe

pid process

2880 coafq.exe
2480 gojab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2880	coafq.exe
2480	gojab.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

gojab.exe

pid	process
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe
2480	gojab.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.execoafq.exe

description	pid	process	target process
PID 4136 wrote to memory of 2880	4136	6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe	coafq.exe
PID 4136 wrote to memory of 2880	4136	6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe	coafq.exe
PID 4136 wrote to memory of 2880	4136	6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe	coafq.exe
PID 4136 wrote to memory of 4780	4136	6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe	cmd.exe
PID 4136 wrote to memory of 4780	4136	6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe	cmd.exe
PID 4136 wrote to memory of 4780	4136	6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe	cmd.exe
PID 2880 wrote to memory of 2480	2880	coafq.exe	gojab.exe
PID 2880 wrote to memory of 2480	2880	coafq.exe	gojab.exe
PID 2880 wrote to memory of 2480	2880	coafq.exe	gojab.exe

C:\Users\Admin\AppData\Local\Temp\6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6c0bf34ab9fea5131166877282eff6933f3d798928ba76ab0f85e17c486c18df_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\coafq.exe
  "C:\Users\Admin\AppData\Local\Temp\coafq.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\gojab.exe
    "C:\Users\Admin\AppData\Local\Temp\gojab.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
370B

MD5
820c4d9437dc37744b63c68c17ef2813

SHA1
0bd7958f489dac92b048227c26c5c00b5a7c087f

SHA256
bc3f9a6ab743229eec241dc4f353a2dbca69ac7842fea4ae5e22aed6e186e47c

SHA512
c3bbc006fec3735c69ec456e33339e21b9be05b259cbe0e0197c8b19e1f351fbf87d2ab61929c810f004d4f1087bec266ec2e43f7ecc93d7638952a1349cd1a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\coafq.exe

Filesize
370KB

MD5
c3d4c4213dd142e3a57e84519960611b

SHA1
b090961baeebf2acd0c29557f8f66d82e7de0bb7

SHA256
b29c59f46ac01b103b1645e32e788dfff1774c6c185bf9a4fb76ec09e972391f

SHA512
3228d3859c5ece7eeb11ffb0c41e5914f0dae23bbf21e31d78e5fd211154a4bae9d979064a63d83e5cc5e716742c6f7e7d62426b1b1024a8e53d690012017b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\gojab.exe

Filesize
303KB

MD5
4181e64105238653613c9a98b6bdf088

SHA1
886d89f6354de64a10a98bfdd126f668d0ae67b7

SHA256
1626e482b6fa34f4e97b22a826f918dc29e55bf0f8ef12d3c08c21d07299f10a

SHA512
16810539e9c69b2b5193ddc6a293179854ce8fe860c4141db3d7efa29848d0a9fcae6ee6b9c58675cc1d4e7ee600973809551c9f0ff21ae6d5120d698579257a

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
c58c07e2caa5290940325638330f04a2

SHA1
d716a233b19a211f4f16732d07f797325c9c1afa

SHA256
804a4b653f53a0ebf4196c28c757d4ab76c29d21524dc197d30ca93cf6ee7533

SHA512
3de31245982e1b55e78e4b24f3ec45ce1106d52ada286f7bb75a6473c3309944b50f7e8e2e9fae115863b7b944ca0887331dcc3d20eb56db3a28b91c350bc925

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads