2a1255c448e737e06f71fed8f0926f0181e4f26c94c4ccae27aa570f31c4eb90

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe
Size 135KB
Sample240509-t76jjafa64
SHA256 2a1255c448e737e06f71fed8f0926f0181e4f26c94c4ccae27aa570f31c4eb90
MD5 92c362b6919745d9d2e85e781d538600
SHA1 48bdab4ec957b801d74ae806fca546ec7f4a8288
SHA512 15fd4940ff3d689b6651bae46d2e37cb1ebc0f5bb8ce468138fb30340cb2dce62d7894fc9b272dc24a134e08d0c3ebf1ea304ace98f34dd8db7f6e19170e70dc
SSDEEP 1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+AnqCoGHve:2++TFnoWTTYBB1hHgN1AnqCoGHve
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\12425 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccpzjka.com"	msiexec.exe

Blocklisted process makes network request 37 IoCs

flow	pid	Process
17	3836	msiexec.exe
18	3836	msiexec.exe
19	3836	msiexec.exe
22	3836	msiexec.exe
23	3836	msiexec.exe
24	3836	msiexec.exe
25	3836	msiexec.exe
27	3836	msiexec.exe
28	3836	msiexec.exe
29	3836	msiexec.exe
30	3836	msiexec.exe
31	3836	msiexec.exe
32	3836	msiexec.exe
51	3836	msiexec.exe
52	3836	msiexec.exe
53	3836	msiexec.exe
54	3836	msiexec.exe
55	3836	msiexec.exe
56	3836	msiexec.exe
57	3836	msiexec.exe
58	3836	msiexec.exe
63	3836	msiexec.exe
64	3836	msiexec.exe
66	3836	msiexec.exe
67	3836	msiexec.exe
68	3836	msiexec.exe
69	3836	msiexec.exe
70	3836	msiexec.exe
71	3836	msiexec.exe
72	3836	msiexec.exe
73	3836	msiexec.exe
74	3836	msiexec.exe
75	3836	msiexec.exe
76	3836	msiexec.exe
77	3836	msiexec.exe
78	3836	msiexec.exe
79	3836	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 884 set thread context of 412	884	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	86

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\ccpzjka.com	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
412	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe
412	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 412	884	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	86
PID 884 wrote to memory of 412	884	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	86
PID 884 wrote to memory of 412	884	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	86
PID 884 wrote to memory of 412	884	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	86
PID 884 wrote to memory of 412	884	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	86
PID 884 wrote to memory of 412	884	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	86
PID 412 wrote to memory of 3836	412	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	87
PID 412 wrote to memory of 3836	412	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	87
PID 412 wrote to memory of 3836	412	92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\92c362b6919745d9d2e85e781d538600_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\syswow64\msiexec.exe
    3⤵
    - Adds policy Run key to start application
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/412-3-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3836-5-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

Download

memory/3836-10-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

Download

memory/3836-8-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

Download

memory/3836-11-0x0000000000BF0000-0x0000000000BF5000-memory.dmp

Download

memory/3836-13-0x0000000000BF0000-0x0000000000BF5000-memory.dmp

Download

memory/3836-17-0x0000000000BF0000-0x0000000000BF5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads