81678fc921334c576373a12e4a6f2b7d2c52bc17b4ba8c4830bf644df42feb19

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe
Size

54KB
MD5

384f3147b9f7bdc7d2d75b29f673ab30
SHA1

d0e580e3ce0a8f009c89d0a0a2e8efd0357926bb
SHA256

81678fc921334c576373a12e4a6f2b7d2c52bc17b4ba8c4830bf644df42feb19
SHA512

ef5370414190da9f5c895859223ca099d2b61335123b362091e79452d2caed2137213c74be935330611067877cf87d9c956dccb3bc9959c14e9176328943f305
SSDEEP

768:MApQr0ovdFJI34eGxusOy9Rp1pLeAxoeC48PqK1OtaP6cCFzENREMZ7N:MAaDJlMsh7pWezEPJB+OZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	sal.exe

Loads dropped DLL 2 IoCs

pid	Process
2612	384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe
2612	384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2940	2612	384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe	28
PID 2612 wrote to memory of 2940	2612	384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe	28
PID 2612 wrote to memory of 2940	2612	384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe	28
PID 2612 wrote to memory of 2940	2612	384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\384f3147b9f7bdc7d2d75b29f673ab30_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2612
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sal.exe

Filesize
54KB

MD5
15aee7959894a57a88770ade6e2820b9

SHA1
b1fb7fee4acdd2132648d7cbe1b89d4fb6f7cfe4

SHA256
d82471772517bc94c2776cc1489dd7109af5bb6bae384fc7ddc924432d4df6d7

SHA512
a307412c73420e2a965619199f36957b1d8b548591ef051e02287706001ebff68016064a7827147a2d15624b415a269a6d9d2707c740435eabb3ecdc983f054d

Download Submit
memory/2612-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2612-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2940-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2940-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download