8bc57e82b4f248b48c0c9686422c05a901f94a4eb4ca04ceeb68a59af7bc7be9

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d3cf55349d43459c14acd41c9be8b70_NeikiAnalytics.exe
Size

302KB
MD5

0d3cf55349d43459c14acd41c9be8b70
SHA1

9f522612d0740821b10522b034cf60df641f550b
SHA256

8bc57e82b4f248b48c0c9686422c05a901f94a4eb4ca04ceeb68a59af7bc7be9
SHA512

35a953c8ca7e0fe77121c8a3b0e29a87b618321422c3161a012136c12d8475eb09e383f3be6edc1330682a2cc93b66dd3007d4d7f9db7936d6ea36356f60b5cc
SSDEEP

6144:VCDM2K8dgQZw88wNrRJQNy+z+t21vjdciLbyyPncWR4IBqUsvU2YYG5YE:VCw2K8WQj8dNyyR1aiLbZPnVRRqUXuE

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2932	tbckyxk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\newtrln.dll	tbckyxk.exe
File created	C:\PROGRA~3\Mozilla\tbckyxk.exe	0d3cf55349d43459c14acd41c9be8b70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2932	2164	taskeng.exe	29
PID 2164 wrote to memory of 2932	2164	taskeng.exe	29
PID 2164 wrote to memory of 2932	2164	taskeng.exe	29
PID 2164 wrote to memory of 2932	2164	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\0d3cf55349d43459c14acd41c9be8b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d3cf55349d43459c14acd41c9be8b70_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2172

C:\Windows\system32\taskeng.exe
taskeng.exe {D50D60F8-FFC7-4572-B4B8-185F86EC3C04} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\PROGRA~3\Mozilla\tbckyxk.exe
  C:\PROGRA~3\Mozilla\tbckyxk.exe -gqpcbye
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\tbckyxk.exe

Filesize
302KB

MD5
fc3d981debae8e887b567c51aa24d932

SHA1
aa9ce8a9fe62e02d8cb37045a3292792b6df13e6

SHA256
93e4464443eb2e58019b856f5b58b20d6dddebd5eabba9bfb56fd1ed8de89089

SHA512
3c6ce6c0190ee7e7748326619389a574c15e758bb8d73dc824e3585998c55840f9d3008f3a142211a8c5da82d10fc8a0aa4170296e694358675195fec45b2a81

Download Submit
memory/2172-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2172-1-0x0000000000370000-0x00000000003CB000-memory.dmp

Filesize
364KB

Download
memory/2172-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2932-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2932-11-0x0000000000990000-0x00000000009EB000-memory.dmp

Filesize
364KB

Download