adccde4f434e718394ecbfd6ee4ccc6f97fd5b1920c3c235563e32eb73a44630

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e339ff29423aa4a7f7bf33125a94630_NeikiAnalytics.exe
Size

205KB
MD5

5e339ff29423aa4a7f7bf33125a94630
SHA1

65ccf1142997173a363c3d20a62b9e29b07f7594
SHA256

adccde4f434e718394ecbfd6ee4ccc6f97fd5b1920c3c235563e32eb73a44630
SHA512

bc718f8ac4b7f4e006223edc12177ede37a575b7c1709a6436b6465eb594731cebd216214c814ad16a81b682ca84c82c8c7c52e6d00d87707eb55b5ad0750f69
SSDEEP

3072:2+ejgWgTsDAJJRjOV2/pwb5ryT5tlDhB2IFTLFZhh2D+0caj3kyRACHfE:qjg3JJF35tlDhB2Cn9ozHfE

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2564	wrvdfyg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\wrvdfyg.exe	5e339ff29423aa4a7f7bf33125a94630_NeikiAnalytics.exe
File created	C:\PROGRA~3\Mozilla\klztrnd.dll	wrvdfyg.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2064	5e339ff29423aa4a7f7bf33125a94630_NeikiAnalytics.exe
2564	wrvdfyg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2564	2636	taskeng.exe	29
PID 2636 wrote to memory of 2564	2636	taskeng.exe	29
PID 2636 wrote to memory of 2564	2636	taskeng.exe	29
PID 2636 wrote to memory of 2564	2636	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\5e339ff29423aa4a7f7bf33125a94630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5e339ff29423aa4a7f7bf33125a94630_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2064

C:\Windows\system32\taskeng.exe
taskeng.exe {4D25095C-6A1B-47F8-8DE4-ECF0D358BDF3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\PROGRA~3\Mozilla\wrvdfyg.exe
  C:\PROGRA~3\Mozilla\wrvdfyg.exe -hzyjzia
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\wrvdfyg.exe

Filesize
205KB

MD5
d9cafc01a8d25509353e439c97a80a29

SHA1
7aaebf0b91378463c816f822d10dfddb51dd34b0

SHA256
8a271eaa6096b24982fb44d8938575c7f6d3b4fc6d18cfc58b6fec7b30c7fd48

SHA512
b5b3ee7ccf51088949e2fefefa21fb5a4c612e1f77efbceb8f18de7c4bfc1e27c6ff1b3c13c609a02446cfd0402f0b6670422da521de4cc46c59658ae62d8ab2

Download Submit
memory/2064-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2064-1-0x00000000002A0000-0x00000000002FB000-memory.dmp

Filesize
364KB

Download
memory/2064-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2064-6-0x00000000002A0000-0x00000000002FB000-memory.dmp

Filesize
364KB

Download
memory/2064-5-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-9-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2564-10-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2564-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download