49d186c065fae0e4cc497c93871a4486b7a75d0642460db904f173b64effa1a2

General

Target

6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
Size

1.5MB
MD5

6b96088902fff1319414f95dd2c4d520
SHA1

e4c491aa83faa5299235626e3092222200ee5125
SHA256

49d186c065fae0e4cc497c93871a4486b7a75d0642460db904f173b64effa1a2
SHA512

c98415095cb7ec975629e60d5be22ff860daa2af2be83cf3297181cb06e478606bcf908732e88ce2c650a0e1547787a7582b0f10d53f2831eeed71763e464503
SSDEEP

3072:DR4jdNqTqHL+3phRrbhqkBSBJmKbgeVMMZC9NbcObtvCmXlwi8MM87cJc4vcqc8J:NafYphSe+dbjMMqcXmr8MMtjyhX9+FL

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\M:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\O:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\E:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\H:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\K:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\L:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\N:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\G:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened (read-only)	\??\J:	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\readme.1xt	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3BC2.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3BE4.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3BE5.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3BF6.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.cab	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3BD2.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3C06.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3BC1.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.cab	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3BE3.tmp	6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	2488	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6b96088902fff1319414f95dd2c4d520_NeikiAnalytics.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 724
  2⤵
  - Program crash
  PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2488 -ip 2488
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.cab

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.5MB

MD5
62e2fcf80941625e86c48ff0f44728c8

SHA1
4491c1f7521f96f3c56bc8c128eaf2d0442a562e

SHA256
9b734e53873031926a0bbb16d2d2451cc73a2cb83077fc78d4d80e4306052c22

SHA512
84f3bd5f2cdfeb1db0e83e15c31f4990ae19d3fcc086af30d8f3ec727dec18cf64fa8c5f15ea85ac2c49e6c0f98b674b13486b60e699aea674639df560e2f2b6

Download Submit
C:\Program Files\7-Zip\7zFM.cab

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3BF6.tmp

Filesize
168KB

MD5
c40cd71c7601387b53c0e59d62880d1e

SHA1
9b09305e0cb7a85c823d514d9dd1e2a431c8a5db

SHA256
90da536777201b8bffd0c2667e3cf8c1781eba777c010e434e85e0e0c5d1c0a1

SHA512
fcaff627a38cc412e0c62e2aec0c7ebc04192f3beab642b0dc237eb11722712ed0141d4e8b4d28f03d191ea7047e7647e5c95c04ffd22633fb0333514e2c70e6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit
memory/2488-0-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2488-67-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download

Analysis

Sharing