9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578_NeikiAnalytics.exe
Size

6KB
MD5

c204ace6e60ccca66ba47784612cbd50
SHA1

dbfa819023002d0c53d99f1881be45bf5317be4a
SHA256

9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578
SHA512

5cee1002e75a5c32f0689b92b523115c0402c915350aa1eef75db69f4317645488fa3d790ce726c7cc00110e5ff0366d040fe565696b0a3509f544fe494d6344
SSDEEP

96:9uKB7r0gHNw0iNwOBVKXbUp8wAnQWRRU1xXHZFYRUd6oZSFI2+hKVo:kKhDt6N7VKQWRREHZuTI5r

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2580	srris.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2580	3816	9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578_NeikiAnalytics.exe	83
PID 3816 wrote to memory of 2580	3816	9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578_NeikiAnalytics.exe	83
PID 3816 wrote to memory of 2580	3816	9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c015ffd8c24188cb768beb5b2fbcb8298f29d416c6c16f4ad1888d570107578_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\srris.exe
  "C:\Users\Admin\AppData\Local\Temp\srris.exe"
  2⤵
  - Executes dropped EXE
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\srris.exe

Filesize
6KB

MD5
f2d77835f6d8530da69ceb4a388b752b

SHA1
2142a0c89e2c7b4316a896e468fa412fe353baec

SHA256
67ad200a37e08f456de5b9e1f72511ccb2ef2417c274d0a0accca533e507d884

SHA512
fb85400389470dc24f5111f6ae525b30c6fe4eb2f2e00158dccd2d9184a463551751c38e8db81aca3c3078549b27811f6a8ed78be331c4e96b7ceebf4042d42b

Download Submit