3815340dcfb559d0caf5c15562bc39712188edf34e2d2694df4caa44a3adb5c3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe
Size

6KB
MD5

7fea26e0af658fadab360b27963a0880
SHA1

45f346728046deb8ce124dac491415f5dab18126
SHA256

3815340dcfb559d0caf5c15562bc39712188edf34e2d2694df4caa44a3adb5c3
SHA512

4433c93685ec80368418f50765f306675583fd13e64c01ebe4e9322fc3718cbaa7d607d7032acd96303f07591132e342497292bf0c51b3ff16ea5c820ecd2446
SSDEEP

96:DJOqSXslYquHnnwR2UM2ClAhxnqXUBuYX:XS8AnwR2FBAukNX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1996	huty.exe

Loads dropped DLL 2 IoCs

pid	Process
1808	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe
1808	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1996	1808	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe	28
PID 1808 wrote to memory of 1996	1808	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe	28
PID 1808 wrote to memory of 1996	1808	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe	28
PID 1808 wrote to memory of 1996	1808	7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7fea26e0af658fadab360b27963a0880_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\huty.exe
  "C:\Users\Admin\AppData\Local\Temp\huty.exe"
  2⤵
  - Executes dropped EXE
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\huty.exe

Filesize
6KB

MD5
ac1580d6343ecf0e4881c06e3a3a988e

SHA1
ee5a12ac64216672adc20b2419120cc4fd5745e8

SHA256
5a571a0b68d678473daea4a3651040b66cc37ed9f750c69908cb9095dcea0b02

SHA512
3c380ebf8556b3375712d2164520061cb627b76b922c8d0466b9db397122d3e5652c6253baab44942dd02e48522598e5e250007186219ba9a2a54d7c43774a88

Download Submit