6eacd5221753b5c2846d49c4eb8475f620e53f829aa231a8eda1ed4a400d9a94

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe
Size

92KB
MD5

2362e1eb155a1f3471a43d6dcbdb7da0
SHA1

59d8e4a19a2692354fc7a5761488cebb61c8f047
SHA256

6eacd5221753b5c2846d49c4eb8475f620e53f829aa231a8eda1ed4a400d9a94
SHA512

1ce28e0d2ac1eb637388de06871821a975379428151c597b0d889cb60660e7eee32c72d40a94927820103ffc794b23a4ed92ee32698fd4f212143907e6278365
SSDEEP

1536:8QOr++vOxt0c5hfHP1qlmv60lHj4UraTPVPSPkP4PjPAkbohaWdV7lObdEZxHwAf:2rFA0c5Olmv60l3LbohaMAuwiNCP7s

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2864	daaoz.exe

Loads dropped DLL 2 IoCs

pid	Process
2888	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe
2888	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe
2864	daaoz.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2864	2888	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe	28
PID 2888 wrote to memory of 2864	2888	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe	28
PID 2888 wrote to memory of 2864	2888	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe	28
PID 2888 wrote to memory of 2864	2888	2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2362e1eb155a1f3471a43d6dcbdb7da0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\daaoz.exe
  "C:\Users\Admin\daaoz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\daaoz.exe

Filesize
92KB

MD5
4df36ef9ee328014602a4d188314f40b

SHA1
03b418afdef643f4911b48b649c35621c69fe955

SHA256
89e45d7add338899a0a2a69920f2175f91d3a5e541a398e41dd3243875f4849d

SHA512
b3c4b1b2dc6474f4758d559fff8666e00d7d5dbbd9ed4ae65e53d7b68888e8496bfae13f4b0fbef9b66dccbed04818023e692ed7f57c9574582b8c5fe8c75479

Download Submit