c2493d3a2eb508f0d7e1f6735f55edd1c3674e6ba2a69307de451a318d25e699

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe
Size

47KB
MD5

2e45ddc0688ee9b835f0e4ca666fdb60
SHA1

d15779690d5bc3be0e5c4dc52fe0b0c1e97904ab
SHA256

c2493d3a2eb508f0d7e1f6735f55edd1c3674e6ba2a69307de451a318d25e699
SHA512

658ae2ddd9eb209361a3ff260ea03587969a5328e13bb5721b2ae9347450bd550bf765ff16358fbdc368b3427a74115f51af73b161a0cc9385d7208a54178737
SSDEEP

768:jvQ5qDLHRdw2iPSMEk/6KxPEMb960yXb8Fq:jvQoLHjw2iWPKxP7vyX40

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3020	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
500	qqwhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\qqwhost.exe	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe
File created	C:\Windows\Debug\qqwhost.exe	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2352	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3020	2352	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe	29
PID 2352 wrote to memory of 3020	2352	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe	29
PID 2352 wrote to memory of 3020	2352	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe	29
PID 2352 wrote to memory of 3020	2352	2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2e45ddc0688ee9b835f0e4ca666fdb60_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2E45DD~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3020

C:\Windows\Debug\qqwhost.exe
C:\Windows\Debug\qqwhost.exe
1⤵
- Executes dropped EXE
PID:500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\qqwhost.exe

Filesize
48KB

MD5
608bf48684bb4ee9306d477acc710f41

SHA1
05b9c278daf0107c9f799be651182d782991893e

SHA256
42d6d6b8d5f73e5d9368e5f37de4ae31415bc5b8e59aba711406087618763be3

SHA512
a91b562a68ec485a612f5492688403cc611bf0923ca8e0d308b2ead83e3f54fd21cb36eaacaf623a806849ccc5a929ab0f84f61f3aba879e0ff20ce59630c1a4

Download Submit