3a8fc10fcc52efecf119c819f4c008138a37b709d0c74be4e88143c9c2d61704

Analysis

max time kernel
32s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 13:25

Target

45c3c90bcf54e594ba6aa8e0a9a0f690_NeikiAnalytics.exe
Size

336KB
MD5

45c3c90bcf54e594ba6aa8e0a9a0f690
SHA1

22ad8253ada0495b7d073022baee77c392159f75
SHA256

3a8fc10fcc52efecf119c819f4c008138a37b709d0c74be4e88143c9c2d61704
SHA512

ea2095d24c9702bbb83c4f88a8ffda6551f2ab8d6bf65638d5b8a2544b982a5d88f4cbc387f6cf05f09b5d2fa92c9a2911667d5ebc2d0c94268075dbf08ad047
SSDEEP

6144:VYXHpYGCleWt3LFCmwg1HGTs7mObLLWtXi3THWL:V4d+mTs7lLLuXiS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	45c3c90bcf54e594ba6aa8e0a9a0f690_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\45c3c90bcf54e594ba6aa8e0a9a0f690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\45c3c90bcf54e594ba6aa8e0a9a0f690_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2104

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\sieil.exe

Filesize
336KB

MD5
c07bff0ea6f6f7b9e1e32f3bad9044d9

SHA1
934a2b41e935c40bc4e3ec0b7fb489fc5272982c

SHA256
920e31af319bc26c2785be6c4e1744376396ecfa9d1af0d3699a6d96e155b7e4

SHA512
706de11714e83451da09e224ac7f6c6eff3e5ba780771226d45c11c60498dea61183f18bf2c601cee23a66af3d1a428ca0fc70999d13ae8c7503edcb0d9213a5

Download Submit
memory/2104-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2104-6-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download