b5e9c1ac582edee24c21ce06d16b2f88097ca43fe440c1920ae13c3e77a02377

General

Target

63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe
Size

2.3MB
MD5

63647c0a8e82ac920a94682790346900
SHA1

075d726baadbc0c2f3bf30a6856068f40cb643b3
SHA256

b5e9c1ac582edee24c21ce06d16b2f88097ca43fe440c1920ae13c3e77a02377
SHA512

07524714521cf6702111d0855d45a4d17008c316ba1b02575718a525478e2d2e75af3bc24e757eb65c6adc559a1ab80e564936eada73fea3206433cd2c815233
SSDEEP

49152:WcKVDBe/gOs61xz/b1WkHlerfJgQmy2EWsb4AYj8UFop3pAWXry9:nKpBnOs61p5Ip9Ve8UFEXry9

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2808	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe
3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe
2808	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\e9d9abc7\jusched.exe	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe
File created	C:\Program Files (x86)\e9d9abc7\e9d9abc7	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe
2808	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2808	3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe	28
PID 3016 wrote to memory of 2808	3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe	28
PID 3016 wrote to memory of 2808	3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe	28
PID 3016 wrote to memory of 2808	3016	63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\63647c0a8e82ac920a94682790346900_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\e9d9abc7\jusched.exe
  "C:\Program Files (x86)\e9d9abc7\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\e9d9abc7\e9d9abc7

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
\Program Files (x86)\e9d9abc7\jusched.exe

Filesize
2.3MB

MD5
74ea066f7b4dd0dfd1f5dec4e1b0f16b

SHA1
cf32da2ffc4eca4b5908409a7e091d1d156f9482

SHA256
1a4e66989fa80473cb0d08b7e6e9427a15dbc55781ea3b3e1d46b4fe15f86396

SHA512
27af8c2aa5fdadd3dd3ed5cd94a85b3bcc2fad67e0dc2ed7aadeeb639ecf212d24ffdb31b82c2a1e88cebcf5de1ea2444a397867792696ff71bcdede93629149

Download Submit
memory/2808-30-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-22-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-36-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-35-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-34-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-19-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2808-20-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-26-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-25-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-23-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2808-17-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-24-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-21-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-33-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-28-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-29-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-32-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/2808-31-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/3016-0-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/3016-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/3016-14-0x0000000000400000-0x0000000000DF0000-memory.dmp

Filesize
9.9MB

Download
memory/3016-15-0x00000000040C0000-0x0000000004AB0000-memory.dmp

Filesize
9.9MB

Download
memory/3016-16-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing