1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe
Size

101KB
MD5

0e236d175f44f4ba67dfd15b506da400
SHA1

80b9f30688c71d3f5b2659a2805c078662298d3b
SHA256

1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730
SHA512

04660b328bce552d78f9bce48d68060fa938ffddbe319c099715f84ccf9c4290f0d85277fa9e400f003a60078288d3d9afd0194879ab8fbaa6bdd6795681969d
SSDEEP

1536:0GYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7+Pa:0fU/WF6QMauSuiWNi9CO+WARJrWNZUS

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
376	wuauclt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 376	4228	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe	81
PID 4228 wrote to memory of 376	4228	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe	81
PID 4228 wrote to memory of 376	4228	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe	81
PID 4228 wrote to memory of 932	4228	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe	84
PID 4228 wrote to memory of 932	4228	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe	84
PID 4228 wrote to memory of 932	4228	1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4228
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  PID:376
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\1cc111ef0afba746a91e9f4764f1ec6c012ea12fe9758df32371cc2f6d1b7730_NeikiAnalytics.exe" >> NUL
  2⤵
  PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\wuauclt.exe

Filesize
101KB

MD5
7fbc6b47c3e00424010d6f9291576394

SHA1
9d73cf915632c09e90474859ea8512b4f6e61b02

SHA256
9a45ee36bc4a498fa330120a9190c122ea0f3ead216afec0617db59851cd158d

SHA512
3e33a841c4c3ea0aaf94509f1c23e3c9819785af3fd9efe490220d71aa2e13ab15306dbe1ed00f92118d6a0a695ed6dab4794bd8cbbc6f1b4b428e5bb44971f3

Download Submit
memory/376-5-0x00000000003B0000-0x00000000003CF000-memory.dmp

Filesize
124KB

Download
memory/376-7-0x00000000003B0000-0x00000000003CF000-memory.dmp

Filesize
124KB

Download
memory/4228-0-0x0000000000610000-0x000000000062F000-memory.dmp

Filesize
124KB

Download
memory/4228-6-0x0000000000610000-0x000000000062F000-memory.dmp

Filesize
124KB

Download
memory/4228-8-0x0000000000610000-0x000000000062F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads