055f8e02bf1fda8b4d8fc3135032b325c65167bcebc77d483e06035a0ac0c129

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe
Size

71KB
MD5

649ee1cb7a0c9a02b93e32b77cab4750
SHA1

23f17db5daeffc5c598eab9a59d24cf32b9f8a08
SHA256

055f8e02bf1fda8b4d8fc3135032b325c65167bcebc77d483e06035a0ac0c129
SHA512

fa3647270be1b8265053b9960469a163c25f741b2279548eca3074cd59de9ae41681a3a44c0d0bdc2e78f07bd0da8fa8b0c8a19f6188ac1821d6604c2745ed3a
SSDEEP

768:TrItKyw5WHXfQmjIiIk9ecAa0Mb96SyX1DLdRXXX5:Tr3Z5IfQmv81ar1yXtZn

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2840	attrib.exe

Deletes itself 1 IoCs

pid	Process
2912	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3004	iuyhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2840	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	28
PID 2648 wrote to memory of 2840	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	28
PID 2648 wrote to memory of 2840	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	28
PID 2648 wrote to memory of 2840	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	28
PID 2648 wrote to memory of 2912	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	31
PID 2648 wrote to memory of 2912	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	31
PID 2648 wrote to memory of 2912	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	31
PID 2648 wrote to memory of 2912	2648	649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2840	attrib.exe

C:\Users\Admin\AppData\Local\Temp\649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\649ee1cb7a0c9a02b93e32b77cab4750_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\iuyhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\649EE1~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2912

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\iuyhost.exe

Filesize
71KB

MD5
3848d322f33927875d963db03c9e9258

SHA1
8eb2bb420c036d90b8aa2d2d525a31a4759056ff

SHA256
c71584fa33b00cd71b72d26842bed0499d76ac0d36f4744e0c9659d9536d0b87

SHA512
07fb7899c77493e8100b7dd78909d2dd98d07f5f2b3021aaa2ee9f87c8832ac00649b6b49a8f6e680841f801fa514fee78a444cff1018fac72e40608769a7931

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads