32f37f1164a0f1526427cfea6f624ea258ae5727763faaad65d3123558910f91

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7d1da043f71de8d035331ae6bed38200_NeikiAnalytics.exe
Size

3.7MB
MD5

7d1da043f71de8d035331ae6bed38200
SHA1

ed355675b7020a78c8ef35dab5f33baae9e3ca10
SHA256

32f37f1164a0f1526427cfea6f624ea258ae5727763faaad65d3123558910f91
SHA512

a986e6559038c1b71e04eb0e846d6d91f5a714cf613f00fd6be54cc3287921a8afda556434da2eecd0f96a771db070cd121f8520b28731a11f83d65fe5af8175
SSDEEP

98304:y3rWjizNfd71aofFsZJzHBKCVKpah3+R1icFW9w1/eNJ4CZ:yWji9iTBKpT1icFb/egCZ

Score

8^/10

persistence vmprotect

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2664	banehvg.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000400000-0x0000000000994000-memory.dmp	vmprotect
behavioral1/files/0x0030000000014342-7.dat	vmprotect
behavioral1/memory/2664-9-0x0000000000400000-0x0000000000994000-memory.dmp	vmprotect

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\banehvg.exe	7d1da043f71de8d035331ae6bed38200_NeikiAnalytics.exe
File created	C:\PROGRA~3\Mozilla\xwmsnym.dll	banehvg.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2296	7d1da043f71de8d035331ae6bed38200_NeikiAnalytics.exe
2664	banehvg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2664	2972	taskeng.exe	29
PID 2972 wrote to memory of 2664	2972	taskeng.exe	29
PID 2972 wrote to memory of 2664	2972	taskeng.exe	29
PID 2972 wrote to memory of 2664	2972	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\7d1da043f71de8d035331ae6bed38200_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7d1da043f71de8d035331ae6bed38200_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2296

C:\Windows\system32\taskeng.exe
taskeng.exe {A8C4959A-3458-469B-B65C-869D71E569D1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\PROGRA~3\Mozilla\banehvg.exe
  C:\PROGRA~3\Mozilla\banehvg.exe -tlnruii
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\banehvg.exe

Filesize
3.7MB

MD5
cb64e16d5614f4c7bba69f72152aca84

SHA1
d697877c4777a71f0596be64a38c423fde639f82

SHA256
cbc47ae30e7430d727ac5926c217458aa31982fdcb3a41154c9b326f3b2bb11d

SHA512
5399c3867a926755b2b36cfccc3e4d33d641361fa7c79583b5af50ecce06729c35fc23498b46b9af49ba67e216fa67e19abacc94f72602597156428324246674

Download Submit
memory/2296-0-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/2296-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2296-2-0x0000000000250000-0x00000000002AB000-memory.dmp

Filesize
364KB

Download
memory/2296-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2664-9-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/2664-11-0x00000000009A0000-0x00000000009FB000-memory.dmp

Filesize
364KB

Download
memory/2664-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2664-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download