bb7cd6c3094e7e9a8c01f4cefee2833e274ba80d432a5e06474d399b60c4dd0b

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe
Size

68KB
MD5

cc67e46ee81afcab2c132bcb46e876c0
SHA1

312104be337f9cad2d2f7973c14f026c99d74322
SHA256

bb7cd6c3094e7e9a8c01f4cefee2833e274ba80d432a5e06474d399b60c4dd0b
SHA512

2d79bdbd7309cf093a87ec842adcca84a82752eccf13a2d0d2e371a8b1338ff6e748f6a8da9d95cc33409c637111b3b417a97bb68251519a63a619a2e7f1e52f
SSDEEP

768:sXuzKmOHnvgn+tOXRMFaIEj+POhVtMI3szUZNzxqcter8rqFeANFyP:u0K/vgn+tB94vDzIUTzxqc8cqlnyP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2420	henis.exe

Loads dropped DLL 2 IoCs

pid	Process
2900	cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe
2900	cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2900	cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe
2420	henis.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2420	2900	cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe	28
PID 2900 wrote to memory of 2420	2900	cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe	28
PID 2900 wrote to memory of 2420	2900	cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe	28
PID 2900 wrote to memory of 2420	2900	cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cc67e46ee81afcab2c132bcb46e876c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\henis.exe
  "C:\Users\Admin\AppData\Local\Temp\henis.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\henis.exe

Filesize
68KB

MD5
f8563b77835c1704ffbbab3cd97e3a02

SHA1
025cf6d39b62f29d255369bf44f7a7850d349f86

SHA256
9ad2cdc57df4877f668ff49448ded96c0508fc32dbf1c2e0d042becca4619a7f

SHA512
0470f5bcb76fcfa3a0219895d6315e65d53171fd7b8765d78fb13a5e6c493eaa505bad74fba0625f9398bac319639a71c1398777beefd73d9e5ea3389af0f219

Download Submit
memory/2420-18-0x00000000004F0000-0x00000000004F8000-memory.dmp

Filesize
32KB

Download
memory/2900-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2900-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2900-7-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download