05a7d3372805b6a230d86a9cbde725d02b820a730d9943f32e96456a544e444a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe
Size

54KB
MD5

70dd033d6248b6a1fbf7104b610c2b20
SHA1

698b8c48a393120daf2938061642f112d080ae35
SHA256

05a7d3372805b6a230d86a9cbde725d02b820a730d9943f32e96456a544e444a
SHA512

0ef5b8dadd6a531eb5ec3d018ecf307f1ea5c63e8759c8d30eed97580d233e42a3385d681a057ed34877b1988a132c5e31beac7fadd50cf3faa51b45e2469cfc
SSDEEP

768:MApQr0DHvdFJI34nGxusOy9Rp1pLeAxoeC48PqK1OtaP6cCFzENREMZ7AJ:MAaAJlzsh7pWezEPJB+O+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2580	sal.exe

Loads dropped DLL 2 IoCs

pid	Process
1640	70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe
1640	70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2580	1640	70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe	28
PID 1640 wrote to memory of 2580	1640	70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe	28
PID 1640 wrote to memory of 2580	1640	70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe	28
PID 1640 wrote to memory of 2580	1640	70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\70dd033d6248b6a1fbf7104b610c2b20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1640
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sal.exe

Filesize
54KB

MD5
c2b2507fceb559b125a5177d3daad755

SHA1
6b2445cf0cd88f9fb7796adf065fcfec60bfe47b

SHA256
025c1334b6090bd6153d77b70ec5aa295ff969a4a3d7a152bc51e0903eec3b43

SHA512
6d32682c629823aac5af1de6ec40f09b43219744c306c6d731c404fb1a91f81faba11ebe2e9b8c03c2616c08da3f5f7a276fdc0d1129bdac9d47e83b4fb70e07

Download Submit
memory/1640-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1640-4-0x0000000000490000-0x0000000000499000-memory.dmp

Filesize
36KB

Download
memory/1640-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2580-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download