d5ac026dfd7e8b95b4ac5ee2978d667d0e53ab0937344fdbc81b707b97fa5b43

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe
Size

395KB
MD5

44c785c522656721a0f313af1f5e6570
SHA1

887c38bdb34356a910b4b73edef21a0ac3d97c23
SHA256

d5ac026dfd7e8b95b4ac5ee2978d667d0e53ab0937344fdbc81b707b97fa5b43
SHA512

2bce689280ca4f11d95958f6a73b8b476e7e5968069ad1fb6530440252fb835b9e832b8f1f11c148413d66ce8b51c89b965204b782287fc50f064569609a06d8
SSDEEP

6144:4jlYKRF/LReWAsUykB9SmGXR9yrOyyoyY4xVtysm6Dx7IPvocPozj1u6JgOM/SJu:4jauDReWMjs9fUgjDj1u6JgL/SVm

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4068	gsmxx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\gsmxx.exe"	gsmxx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 4068	1852	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe	83
PID 1852 wrote to memory of 4068	1852	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe	83
PID 1852 wrote to memory of 4068	1852	44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\44c785c522656721a0f313af1f5e6570_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\ProgramData\gsmxx.exe
  "C:\ProgramData\gsmxx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
395KB

MD5
23c91a781c4bec29ff51cf6931acf2da

SHA1
fa8c4ada0c54b119f4b36df66b1226bc3e32233b

SHA256
3a5998a20eb5815472cb1ded731b5712f3457afb4cf5a22179733371e67598ca

SHA512
ac42298e7a5d5bbf0f63e85dfaaf066e86e1705ddcf67dce342c8b4a50c608cfced62df29f8d3fa9b58a6bfb1f763f10eb2358ff3a835d665059d3daf448917e

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\gsmxx.exe

Filesize
258KB

MD5
ede572bd2567aa156be946eb4d9d7c8d

SHA1
be6758f46e3ec9dd8ce8fd647af04b04754f91ee

SHA256
865cd0775664b112f15709f95eca4d7217b07ce1926a40a30a51e6c2b35aa4ce

SHA512
f41f6f5370bf30172b215fa1a1f2b7e658b4a939956520ab56b03e40498aaa2a77dc28a47aaaca577830b433e52614429167471fe8c1d4f879ffa23f7e39dc27

Download Submit
memory/1852-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1852-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1852-8-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4068-130-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads