231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e_NeikiAnalytics.exe
Size

38KB
MD5

041c7f004e6641ad52d1e4606abb03b0
SHA1

d18bf6f9261736bdd1013facfd8bcc81d4e7974b
SHA256

231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e
SHA512

9c9c2dd91e51c469056430248c5d972f1e6d9d51956e5bcf4a6832a35a0c0dead32348b585f6e6ef6392d8e2b4716a80c866bd014fc02ba02e224df55ea84c8f
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm0UpaU:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
220	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 220	3564	231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e_NeikiAnalytics.exe	81
PID 3564 wrote to memory of 220	3564	231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e_NeikiAnalytics.exe	81
PID 3564 wrote to memory of 220	3564	231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231fbcfc2c520133e71fd3b34b306330f83e74c0d7a70648a7df0cb7b112c82e_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
39KB

MD5
2e158e249d523dc75fa0b0ca177ca13e

SHA1
c7007ad812e866b8699778b95340c5948c777333

SHA256
9e579aff06025ad92d0ce3ff3bf74dda8bd79839c13ed1315d4811e8e0c236f7

SHA512
ed8bc0e53868e07fc54282be6a4b73597fa36e7f9b570abdb726e013b63dc5a76ec1c0c66076ad6b7676be7f36ff22ed971e91b0c6d1b0375bdc591629e3d4fb

Download Submit
memory/220-25-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3564-8-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/3564-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3564-0-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download