3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8

General

Target

3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.exe
Size

467KB
MD5

52533097086db0134f6d816bb2cc51e0
SHA1

5b8150e3b6841ff42edcda4d5dea101ab1bbc008
SHA256

3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8
SHA512

5f65b967e3f65be7d7c0ecb58072ebc5a4ac731a6a0ac4f06a71095fdac40ad1b16309053307a5183554b8471f83c3c1fe8cdf6eb52dba8d5649677a7630e51c
SSDEEP

6144:mSyAAwKrd01YZW9mhO81rtfTWZGy1Q34HOSR4R5DLRUKT5Nqd3j4CJcAHYVOFf0Z:PYO1QIubR5hzy3MwZec8WgQC

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	DAFE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4888	DAFE.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	DAFE.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1660	WINWORD.EXE
1660	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4888	DAFE.tmp

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1660	WINWORD.EXE
1660	WINWORD.EXE
1660	WINWORD.EXE
1660	WINWORD.EXE
1660	WINWORD.EXE
1660	WINWORD.EXE
1660	WINWORD.EXE
1660	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4888	1892	3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.exe	88
PID 1892 wrote to memory of 4888	1892	3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.exe	88
PID 1892 wrote to memory of 4888	1892	3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.exe	88
PID 4888 wrote to memory of 1660	4888	DAFE.tmp	89
PID 4888 wrote to memory of 1660	4888	DAFE.tmp	89

C:\Users\Admin\AppData\Local\Temp\3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\DAFE.tmp
  "C:\Users\Admin\AppData\Local\Temp\DAFE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.exe DF8CE737797B3AEF02E2AE6F202BF234C0020DD95ED0BF4057ECD664F11C5739B3C5CFE84F8835B79A7A167D79A234E3259D1952B6C7FEC4F094593DE014680E
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4368,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
1⤵
PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3a6a21c001051fa8cac77773bace4efb2b6e2171a199c525da64a89ee572d8f8_NeikiAnalytics.doc

Filesize
35KB

MD5
59975947e6db92e743655ebdf2e3c495

SHA1
5e967d85a4df28f9fed485156919a14fb411d18d

SHA256
83c9df8884ffd5b51bdbdb9314d587477ecf50c3144c6c230ded3a3041f24e05

SHA512
1cdc533bcc9bf50c69dd3a516c4fff8f24cf2ba9ecf1df885c12d4f459727b63c2d7f1a388ac0a4ac2fe59fe1bd5f5cb623001c736df33490fb245e06d7af692

Download Submit
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp

Filesize
467KB

MD5
fda01abf3a2d6a2456b57d475c257251

SHA1
60b2c700aa540e5a5af70e08951b97bb81480979

SHA256
72858c4e16c9a3db6c20e9d4b6099d5d02d77f7038cda0a171fe299002fc0ccb

SHA512
452c580ea03cfdbfbea1bc66dad9eaed986ad4eff22efdc49ba18c7a1eb98e1b6dd455109004d158a1c356cb9eaab675a9c66e6555006b4c6a968b84b2cfa2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD2993.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1660-28-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-29-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-18-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-20-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-19-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-22-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-21-0x00007FFF93BAD000-0x00007FFF93BAE000-memory.dmp

Filesize
4KB

Download
memory/1660-23-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-24-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-25-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-26-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-27-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-562-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-30-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-31-0x00007FFF51230000-0x00007FFF51240000-memory.dmp

Filesize
64KB

Download
memory/1660-558-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-32-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-33-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-34-0x00007FFF51230000-0x00007FFF51240000-memory.dmp

Filesize
64KB

Download
memory/1660-35-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-37-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-36-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-559-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-560-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1660-538-0x00007FFF93B10000-0x00007FFF93D05000-memory.dmp

Filesize
2.0MB

Download
memory/1660-561-0x00007FFF53B90000-0x00007FFF53BA0000-memory.dmp

Filesize
64KB

Download
memory/1892-4-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1892-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4888-6-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4888-17-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads