74357c8b3f9fc49011e4b15993eb5497fc97d74a99a60469e9c9a0ceddc8e02c

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe
Size

95KB
MD5

b19b42d5a60ff31759080ed35c9efb80
SHA1

a183add0a42c50a9f221032af6770c1915537f18
SHA256

74357c8b3f9fc49011e4b15993eb5497fc97d74a99a60469e9c9a0ceddc8e02c
SHA512

ddafb1e8666c14955436b8bdd5fffacbfc760c506788a504ab0fdcedf742bd509744b791ca7a0f146f18cb1ac80d6596ff58c17fdcb5fc453c43e612d3f55587
SSDEEP

1536:AEsBuoFn7UZ+LtdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsbEYTjipvF2G4ezi:AEjot7UQLtdgI2MyzNORQtOflIwoHNVs

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
928	kgfdfjdk.exe

Loads dropped DLL 1 IoCs

pid	Process
2772	b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 928	2772	b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe	28
PID 2772 wrote to memory of 928	2772	b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe	28
PID 2772 wrote to memory of 928	2772	b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe	28
PID 2772 wrote to memory of 928	2772	b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b19b42d5a60ff31759080ed35c9efb80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
  "C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe"
  2⤵
  - Executes dropped EXE
  PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe

Filesize
95KB

MD5
21f1db0c14ffef5ec7f8e2f078dd1fd2

SHA1
b562379972649ca4fcd44e4921059484584206c7

SHA256
ca836095b0fb6e067f50f8756dab96701fb5f3aa828a2d63512e0a0ee5c207a1

SHA512
26a0695ef0a0eefabd3583d9bb671da9a72e2f29d94288b54662c1df316ee93f7ff80b9346b60fab2668a5d1e5f6e3173b318e07c865d092a12742ea474241b6

Download Submit
memory/2772-1-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download