e30d634c17a4094ba5013f88c892dcb079df4a037d20caf47296515ac9680b5e

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe
Size

58KB
MD5

e363ac06ac2209a7c27186ad2351e3a0
SHA1

d96cbe2ad7edcf586387d8e296ade9d8dd213a6d
SHA256

e30d634c17a4094ba5013f88c892dcb079df4a037d20caf47296515ac9680b5e
SHA512

3bcd06e3a995d767098185f4772c2adb673f2e331b680d3f4b88caf2b1fe42350b7e817392c2a0cd82c90e9b2232b295ece7b86bc71903411c1ea23fb9a8c6a7
SSDEEP

768:9qSqC8+N5ozQQ8ncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtSqklP3:9rqfzQQ8amN8835mv7CUroqklP3

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2512	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2272	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe
2272	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\a21e8fc6\jusched.exe	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\a21e8fc6\a21e8fc6	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe
2512	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2512	2272	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe	28
PID 2272 wrote to memory of 2512	2272	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe	28
PID 2272 wrote to memory of 2512	2272	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe	28
PID 2272 wrote to memory of 2512	2272	e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e363ac06ac2209a7c27186ad2351e3a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\a21e8fc6\jusched.exe
  "C:\Program Files (x86)\a21e8fc6\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\a21e8fc6\a21e8fc6

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
\Program Files (x86)\a21e8fc6\jusched.exe

Filesize
58KB

MD5
6bb6e6690606d4439546f54f5193b423

SHA1
811532bb1e844be79c45959d049f39b0d385c3a9

SHA256
370815fbc73dc0a3df81c71c010ffe8e12b8f7504b22c8db4652bc9fee84092a

SHA512
c28c7f80d61aca7bf507fc9ec45e25596a96c9536c14eff2db8816a42ac7db147c3739083540226d5258d6cdaa3b80f09dce0481863e4f14bfdebf717785dff4

Download Submit
memory/2272-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2272-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2272-4-0x0000000000401000-0x0000000000406000-memory.dmp

Filesize
20KB

Download
memory/2272-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2272-11-0x00000000040F0000-0x0000000004134000-memory.dmp

Filesize
272KB

Download
memory/2272-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2512-18-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2512-21-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download