eb33b8fdf4db107477c2373fbb00407fd91a18d4ce7fa21d89f77cc1760ebb0a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe
Size

33KB
MD5

68d4b9c069acbc49cd8619114abd8100
SHA1

bc233adfa9e0c4be7048adb02164e85ca6ac6cfa
SHA256

eb33b8fdf4db107477c2373fbb00407fd91a18d4ce7fa21d89f77cc1760ebb0a
SHA512

8b92263780c794d79f741f33ccd2984719e06c103bda1e3c00705ceee402177bae0de17f00a6485f45c760727c09eeaed92651747945250ec24ae96223714081
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStEkcsgROA:b/yC4GyNM01GuQMNXw2PSjSKkcJRb

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2908	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2180	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe
2908	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2908	2180	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 2908	2180	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 2908	2180	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 2908	2180	68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\68d4b9c069acbc49cd8619114abd8100_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
33KB

MD5
274eb5f010b6c1311e94efce19b50bb6

SHA1
cb2f635103ae585da2c5293f70e77beb22b4fada

SHA256
e90208715ecab8a648587a53aa6cb1d9fc7bd26c578c34689343151370943314

SHA512
fe5c0842dbb56ccd006dc26326ce121cf5a3debeb1a7aad0c57afd1b7d4558ab93e73bc64ea598e677dc2beba7c9d4bfa4c5c1a675489a97af8bacdb7f285227

Download Submit
memory/2180-8-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2180-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2180-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2908-23-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download