0a543d55bc9b9e51367d65b054bb5e97bab3e08a07604195db075aa4a257d2cb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe
Size

54KB
MD5

98a92335748d7b3a25e98db8f54c6d50
SHA1

ce1831b2fb3c897858b7061e46e142756807912e
SHA256

0a543d55bc9b9e51367d65b054bb5e97bab3e08a07604195db075aa4a257d2cb
SHA512

90b0873340dbf9ce814e082f2a75c485ec7be38b6fbeee31ea90a08fe1ccd488d03b770d93d9280dfc192d48c23cdc755e959815a1004891da372c45a81480a1
SSDEEP

768:jxDDnyAiIbhn+oRTaFSxjquEDFAnA1tLRNk2djaYoCMHosOAJy:jxDDnd1Raqq2uBNdSCMM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2164	hcbnaf.exe

Loads dropped DLL 1 IoCs

pid	Process
2088	98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2164	2088	98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe	28
PID 2088 wrote to memory of 2164	2088	98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe	28
PID 2088 wrote to memory of 2164	2088	98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe	28
PID 2088 wrote to memory of 2164	2088	98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\98a92335748d7b3a25e98db8f54c6d50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
  2⤵
  - Executes dropped EXE
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hcbnaf.exe

Filesize
55KB

MD5
417e924b30f783a7570403b8149b1aea

SHA1
4409497d006e43a73cba9d1d96e773f747cf4548

SHA256
772be44acb574d7ccade56a9310f213ef723b72975312f455c297ae8089cf149

SHA512
2f47bdece58de7a684606c0ec350e8090cd61ba77d34f0ebc0353a85a58cd4d2c4ad7e3bc9bc40bf63ce1dbd5eaa0b5f9bd6b1f1817e2c320067226a669fd70f

Download Submit
memory/2088-1-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/2164-8-0x00000000000C0000-0x00000000000C4000-memory.dmp

Filesize
16KB

Download