Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 08:32
Behavioral task
behavioral1
Sample
6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe
-
Size
184KB
-
MD5
8a48a1ac9d21c20376bdefd4b5f31750
-
SHA1
d06505ca57be8571995b39a1a74ebb3328e6a023
-
SHA256
6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8
-
SHA512
9004f1d42593161dacd2ff2727a8701babb8c69547f03ccbe6d6ccf6710f2fc62c8f3034fcafea5dc7557d44cb94d50df9067cc175bbc2bf246ba3097aa203bd
-
SSDEEP
1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgd:Thuk8QsH47nW5ppkoI4KEAUgd
Malware Config
Extracted
urelas
112.175.88.207
112.175.88.208
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
huter.exepid process 4724 huter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exedescription pid process target process PID 1624 wrote to memory of 4724 1624 6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe huter.exe PID 1624 wrote to memory of 4724 1624 6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe huter.exe PID 1624 wrote to memory of 4724 1624 6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe huter.exe PID 1624 wrote to memory of 3616 1624 6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe cmd.exe PID 1624 wrote to memory of 3616 1624 6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe cmd.exe PID 1624 wrote to memory of 3616 1624 6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6cf730427776e63fb31ca147bd0de6d35006ca43e46b7cd55e64e2c2ec6db0c8_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:3616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD5ede6388dfbb03ff576508b085d03e793
SHA171d2e779ac6ed074b5698651a8c7fa3b047ccb50
SHA256779c0d78580692dadb2978ddfcd44d68f8282bb3453c638c9a4c2feecc1b96f8
SHA512097e3b9b2ad80944e542785db3a9062ecb2c657192d96659dcc5267f362b186c91722f2bc103f19ef895e6d9821cf33d262569fae23605888d75f38d2e30093b
-
C:\Users\Admin\AppData\Local\Temp\huter.exeFilesize
184KB
MD5818937e4c6051d85287efae9f81bac2c
SHA187bb237a6c7fe362b1a9a23d1b75204a7ab1d998
SHA25606fd4972ba244af771c53d8411c5d31d09f74866ac4924a591aaea1d831979c7
SHA51234bc3ff5b7c2cc49557b54d8fa05bc61a239f93d6ff7dd65ddc46c7de3b0df99db055be48a908ceb60c44f25aea3685c52edbabb38275523fe18f4d5106452fb
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
368B
MD5d056be92e5037d3ba940dda0d3b4e517
SHA17f633aa9d6bff2d2c7851b0f8a825f6c1ce88122
SHA2567853f0e7ad7c434c2ee078237592e75bcb0dd9270e2db37cdffd2a7499b944b3
SHA51288b0564716c13199c28bf21b64bdcb67146b4b1c41bde2aece2489e8ad5e058e45d6d1b5c3855d19035f635259ee0fe7d988c989ddc6a0a4d4043bd04f6f4831
-
memory/1624-0-0x0000000000D30000-0x0000000000D61000-memory.dmpFilesize
196KB
-
memory/1624-17-0x0000000000D30000-0x0000000000D61000-memory.dmpFilesize
196KB
-
memory/4724-15-0x0000000000CF0000-0x0000000000D21000-memory.dmpFilesize
196KB
-
memory/4724-20-0x0000000000CF0000-0x0000000000D21000-memory.dmpFilesize
196KB