Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 02:45
Behavioral task
behavioral1
Sample
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe
-
Size
72KB
-
MD5
5f9067b15272efe16e3d65470ba47980
-
SHA1
bec04efe075fd29bcdba9ceefc55e18466555fae
-
SHA256
080cea8881adc3df47de80107238a1d4aed2c1d57307c93a71636e5be4e4fae6
-
SHA512
391b37701b00f17598513985f57bf8c9f6666674bb2a5beabbc5f41d9f0eab7fe9a34d0a3d6106e5e9bd1c428d2125cc435d762c6e23d9cc7f385366ba36d04c
-
SSDEEP
1536:DOa2kZ+qcAGVRIcUjmTeyovQe1RLP0sLJtoz9ZDu7GOXTm:DOYZTBORVUjtvR1L96BSXK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Flaseher.exepid process 126872 Flaseher.exe -
Loads dropped DLL 5 IoCs
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exepid process 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2060-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2060-102-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2060-445520-0x0000000002760000-0x0000000002782000-memory.dmp upx behavioral1/memory/126252-445529-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2060-445532-0x0000000000400000-0x0000000000422000-memory.dmp upx \Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral1/memory/126252-445560-0x0000000003340000-0x0000000003362000-memory.dmp upx behavioral1/memory/126872-445578-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/126252-473521-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exedescription pid process target process PID 2060 set thread context of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exeFlaseher.exepid process 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 126872 Flaseher.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.execmd.exedescription pid process target process PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 2060 wrote to memory of 126252 2060 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 126252 wrote to memory of 126688 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe cmd.exe PID 126252 wrote to memory of 126688 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe cmd.exe PID 126252 wrote to memory of 126688 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe cmd.exe PID 126252 wrote to memory of 126688 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe cmd.exe PID 126688 wrote to memory of 126824 126688 cmd.exe reg.exe PID 126688 wrote to memory of 126824 126688 cmd.exe reg.exe PID 126688 wrote to memory of 126824 126688 cmd.exe reg.exe PID 126688 wrote to memory of 126824 126688 cmd.exe reg.exe PID 126252 wrote to memory of 126872 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe Flaseher.exe PID 126252 wrote to memory of 126872 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe Flaseher.exe PID 126252 wrote to memory of 126872 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe Flaseher.exe PID 126252 wrote to memory of 126872 126252 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\VBCIA.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VBCIA.batFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
72KB
MD521e66bfa88554421fca350dbaae1ddea
SHA1f9962b50afa2a5dbd3e87ff68d961407f3599d39
SHA256ba94f8725146be4987f1ee6147103c85adbdf28b0919856e765f4f08f5e3e6c3
SHA5129799acbf28a631eca9050381999edcc488ee2f5905d3c438c828814f0a35d7343aa8d1faf3813af19d954844fa4aaf01cc3a937c59474ee4becf21f871896728
-
memory/2060-445520-0x0000000002760000-0x0000000002782000-memory.dmpFilesize
136KB
-
memory/2060-11-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2060-21-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/2060-34-0x0000000000416000-0x0000000000417000-memory.dmpFilesize
4KB
-
memory/2060-42-0x0000000001D70000-0x0000000001D71000-memory.dmpFilesize
4KB
-
memory/2060-52-0x0000000001DB0000-0x0000000001DB1000-memory.dmpFilesize
4KB
-
memory/2060-102-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2060-65938-0x0000000000416000-0x0000000000417000-memory.dmpFilesize
4KB
-
memory/2060-0-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2060-3-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2060-445532-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2060-9-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/126252-445529-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/126252-445560-0x0000000003340000-0x0000000003362000-memory.dmpFilesize
136KB
-
memory/126252-445574-0x0000000003340000-0x0000000003362000-memory.dmpFilesize
136KB
-
memory/126252-445573-0x0000000003340000-0x0000000003362000-memory.dmpFilesize
136KB
-
memory/126252-473521-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/126252-495298-0x0000000003340000-0x0000000003362000-memory.dmpFilesize
136KB
-
memory/126252-495291-0x0000000003340000-0x0000000003362000-memory.dmpFilesize
136KB
-
memory/126252-495284-0x0000000003340000-0x0000000003362000-memory.dmpFilesize
136KB
-
memory/126872-445578-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB