d5ac026dfd7e8b95b4ac5ee2978d667d0e53ab0937344fdbc81b707b97fa5b43

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe
Size

395KB
MD5

44c785c522656721a0f313af1f5e6570
SHA1

887c38bdb34356a910b4b73edef21a0ac3d97c23
SHA256

d5ac026dfd7e8b95b4ac5ee2978d667d0e53ab0937344fdbc81b707b97fa5b43
SHA512

2bce689280ca4f11d95958f6a73b8b476e7e5968069ad1fb6530440252fb835b9e832b8f1f11c148413d66ce8b51c89b965204b782287fc50f064569609a06d8
SSDEEP

6144:4jlYKRF/LReWAsUykB9SmGXR9yrOyyoyY4xVtysm6Dx7IPvocPozj1u6JgOM/SJu:4jauDReWMjs9fUgjDj1u6JgL/SVm

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2332	xxnbrk.exe

Loads dropped DLL 2 IoCs

pid	Process
2184	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe
2184	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\xxnbrk.exe"	xxnbrk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2332	2184	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe	28
PID 2184 wrote to memory of 2332	2184	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe	28
PID 2184 wrote to memory of 2332	2184	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe	28
PID 2184 wrote to memory of 2332	2184	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184
- C:\ProgramData\xxnbrk.exe
  "C:\ProgramData\xxnbrk.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache .exe

Filesize
395KB

MD5
716d699eae8dbb4354ee2968968b15bc

SHA1
d2905770fcdd404741a1926f93eeae18c73e7d40

SHA256
3208e7052758ac84e086032473e976c504e359ab159591066244ae8cc56a11d7

SHA512
22848034a5006790973b9a94a09407b88ef624b3d091ff35bf93d86b2261f87635f73336e1ede11f73efd0691dc2c79f42c7401052942cc7c9def0e3cdeaa545

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\xxnbrk.exe

Filesize
258KB

MD5
ede572bd2567aa156be946eb4d9d7c8d

SHA1
be6758f46e3ec9dd8ce8fd647af04b04754f91ee

SHA256
865cd0775664b112f15709f95eca4d7217b07ce1926a40a30a51e6c2b35aa4ce

SHA512
f41f6f5370bf30172b215fa1a1f2b7e658b4a939956520ab56b03e40498aaa2a77dc28a47aaaca577830b433e52614429167471fe8c1d4f879ffa23f7e39dc27

Download Submit
memory/2184-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2184-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2184-12-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2332-135-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads