8e3a01e4d742e9b61a3ed7774ad8cbeb5990fbed95f419be0480913df26add7e

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe
Size

64KB
MD5

2d033e6a2827b22c6867c1cead1a2570
SHA1

f5bdb89049eec28167a17e84f75f7c8c0ce63ef7
SHA256

8e3a01e4d742e9b61a3ed7774ad8cbeb5990fbed95f419be0480913df26add7e
SHA512

a0c73cdeeee10e2e411020056c6e446684ba08b70e351d7c008b2035940063e63af4607ed67d9685ba92d50179c8214b6f2e3d49426233241072ec9b436f773b
SSDEEP

1536:2LFbQafrACEVLUQ/HItWt68/gQGSdsPooooTVVVO:Af8CE/HIM68/gtSs4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3060	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1228	zskhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zskhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2984	2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3060	2984	2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe	29
PID 2984 wrote to memory of 3060	2984	2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe	29
PID 2984 wrote to memory of 3060	2984	2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe	29
PID 2984 wrote to memory of 3060	2984	2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2d033e6a2827b22c6867c1cead1a2570_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2D033E~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3060

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zskhost.exe

Filesize
64KB

MD5
453281549d544d914f7f4dad18d15403

SHA1
2b2721b099fcd62caf0a2f58c25e7a0d607f686d

SHA256
c4762783fbc4db5a3ca8094c9e8c30058270fd97684a3dee2b673f3ffa38c2ff

SHA512
8838810161b0dbb0e33d45109676de2d64c3dc159daabdfc819c89e6efb32937c4eab31fd0eb45e132efe5fc652f2d90989a6acd1594b818c1502161d969b86c

Download Submit
memory/2984-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download