135f68fb08d6b90b4b86524e7fb3ae30b9f21fe20471c66d2d176c4e4840e163

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
Size

90KB
MD5

39627cab2e69713eda6c66a73b9dc730
SHA1

992e6083bbb0de9c69aeb10e81553b1b2607a264
SHA256

135f68fb08d6b90b4b86524e7fb3ae30b9f21fe20471c66d2d176c4e4840e163
SHA512

c28b61b824fd48534ee3b86e7670404d72d9a38eb35b7dd5938caac7d45e1cc94702322f3a782258134f120caccbb591d7fd25f35c11256c2f48af808680c554
SSDEEP

1536:lDcfLfeb5Ep1FzgyXVdtnVHNWnnn6maaaBrrrM++++Y:lD2LNnFzgyXVd1Beaaaj

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2456	attrib.exe

Deletes itself 1 IoCs

pid	Process
2648	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2216	zskhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2456	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	28
PID 2240 wrote to memory of 2456	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	28
PID 2240 wrote to memory of 2456	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	28
PID 2240 wrote to memory of 2456	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	28
PID 2240 wrote to memory of 2648	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	31
PID 2240 wrote to memory of 2648	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	31
PID 2240 wrote to memory of 2648	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	31
PID 2240 wrote to memory of 2648	2240	39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39627cab2e69713eda6c66a73b9dc730_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\zskhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\39627C~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2648

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zskhost.exe

Filesize
90KB

MD5
43c19c6a26d756fe8ce9195e4035e3c4

SHA1
7c7b02ccace276f4a341d3aeace6e987add663f4

SHA256
f218d4d9342eb8a123bce6add62e7935617168e23ce709494b184500c32b3b17

SHA512
8617d1182feb5d2378e3b65f43029024485844b97351101245f9becd7ec8d5b8f525f8a89c77a3918df1ed1334727a2cc4e2d85a11cf905b264d1f9492138fa2

Download Submit
memory/2216-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2216-7-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2240-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2240-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads