Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 03:49

General

  • Target

    62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe

  • Size

    29KB

  • MD5

    62a9cdcdafa23b131f1d70229f934640

  • SHA1

    d8f23cf9cb646ef56fa13cb0cdd0ec6fac40a600

  • SHA256

    937181e8bb7cc22385c16af1566fade073177c7a3bbaebff4b58eed62820d037

  • SHA512

    fc4d6efbdfa99406a3fe0a8f78dd5c94c146a6e6e078aed8e32a120804d68308f72b891b8e1986784725d06c502f21ba9486b3bb1f92e08efe5658fe9df2d7a9

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/o:AEwVs+0jNDY1qi/qw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2688

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpC60F.tmp

          Filesize

          29KB

          MD5

          8518b64ad7b409819ac545936252a955

          SHA1

          303db2249d8b92ccde456238fffee5d3e862b4d5

          SHA256

          7f0a48cbb21e260a0bfd7b4a4df0c7ed6cffbea8c03677a9baccd03f80b98849

          SHA512

          94756a04bcdc3d573f5868054adab8ef64b5b876fbd2bcd846ef3ff2e7c13cf09638615269f078679491d123d6dd0040cd669248ab4991ab8326ce084f771458

        • C:\Users\Admin\AppData\Local\Temp\zincite.log

          Filesize

          320B

          MD5

          dd95f92d26a1dc0cc65344b638831359

          SHA1

          4514fc3db9dae48ab2621ec7ac83bf1f95d9f943

          SHA256

          7725a3d2a0c1898ce97fb67f3f0eea67ae6a2e9d3f052af40df15fa5050620e5

          SHA512

          0b9d6fddaad56dd67b4f773d60b4be73206dab45818a77ae6b3ff2dc8fa27e492b96e2466fc9037a829a618f6c7f29ee705e673ee96b81768aead8736adada4c

        • C:\Windows\services.exe

          Filesize

          8KB

          MD5

          b0fe74719b1b647e2056641931907f4a

          SHA1

          e858c206d2d1542a79936cb00d85da853bfc95e2

          SHA256

          bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

          SHA512

          9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

        • memory/2240-4-0x0000000000220000-0x0000000000228000-memory.dmp

          Filesize

          32KB

        • memory/2240-3-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/2240-79-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/2240-10-0x0000000000220000-0x0000000000228000-memory.dmp

          Filesize

          32KB

        • memory/2240-17-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/2240-73-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/2240-24-0x0000000000220000-0x0000000000228000-memory.dmp

          Filesize

          32KB

        • memory/2240-54-0x0000000000500000-0x0000000000510200-memory.dmp

          Filesize

          64KB

        • memory/2688-36-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-29-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-43-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-48-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-53-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-31-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-55-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-41-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-23-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-18-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-74-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-78-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-11-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-80-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2688-85-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB