f529640e33f7cba15e8a371a4b080e5b7227bf69e5d9afbdeef27c8e595d511f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 02:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d84e533753e2f2f9daef05dab0bb050_NeikiAnalytics.exe
Size

2.6MB
MD5

5d84e533753e2f2f9daef05dab0bb050
SHA1

d25b093184164483aa818ad49779d632cc6839eb
SHA256

f529640e33f7cba15e8a371a4b080e5b7227bf69e5d9afbdeef27c8e595d511f
SHA512

89f58b09b62c5718d556369014352c612721fec9a31a850d9892b3766dd288c67519388d0989334948df99aeb498ba4df64808484bf29fef29678ffc71b2c88b
SSDEEP

49152:nYVs0arn5QxAT/hh7VMDQivgBInoV9ntfV4sMeXKdPQ5k3ApdpX:YSrrmu/hFVoLiIoV9t6RdPtO

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1392	5d84e533753e2f2f9daef05dab0bb050_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1392	5d84e533753e2f2f9daef05dab0bb050_NeikiAnalytics.exe
Token: SeLoadDriverPrivilege	1392	5d84e533753e2f2f9daef05dab0bb050_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5d84e533753e2f2f9daef05dab0bb050_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5d84e533753e2f2f9daef05dab0bb050_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-0-0x00000000043F0000-0x00000000044CA000-memory.dmp

Filesize
872KB

Download
memory/1392-2-0x00000000043F0000-0x00000000044CA000-memory.dmp

Filesize
872KB

Download
memory/1392-5-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/1392-4-0x00000000002C0000-0x00000000003C0000-memory.dmp

Filesize
1024KB

Download
memory/1392-3-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-6-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-7-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-8-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-9-0x00000000043F0000-0x00000000044CA000-memory.dmp

Filesize
872KB

Download
memory/1392-11-0x00000000002C0000-0x00000000003C0000-memory.dmp

Filesize
1024KB

Download
memory/1392-12-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/1392-10-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-13-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-14-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-15-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-16-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-17-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-18-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-19-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-20-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-21-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-22-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-23-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-24-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download
memory/1392-25-0x0000000000400000-0x0000000002737000-memory.dmp

Filesize
35.2MB

Download