Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12-05-2024 12:50
General
-
Target
0ffa9896301effd41a92fb1a5e962100_NeikiAnalytics.exe
-
Size
135KB
-
MD5
0ffa9896301effd41a92fb1a5e962100
-
SHA1
b58445f2776136fd9718916e87f792533a17b8eb
-
SHA256
a8fb298d3218040c5c577c00605dc993f0e3d336ccfa55e2f319a58b56ab9fe7
-
SHA512
43ff652151021680497eddc95cd240d28eece9748fd3d36305eb5cf1e9088581a46892ed7224dc04b415e448c22d1c8a9e6d5c650b3c3e1ad864f07350c061f0
-
SSDEEP
1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVwE:4VqoCl/YgjxEufVU0TbTyDDaluE
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ffa9896301effd41a92fb1a5e962100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ffa9896301effd41a92fb1a5e962100_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5e691b21cfeca24fe424039494e61e59c
SHA1baf9650e04977b92651cc6a0ab1dcafaa9759bed
SHA25660f52c996ac06d369e323a32f7ca8272e36dfac642ba31b55353f39ae1e18287
SHA5126e69f4d3b735e378ef2e1214d81b546de2ed584b14834d9262d12d11475e6a168691777f7a6e0314f8bf4078a70cb0f3f1ec11f6bf4e1d74343ebe4cd609fb58
-
Filesize
135KB
MD5f4ff4dd70bd9044d89aa7daaa5c86df8
SHA1cffd0d57ed35a8bd87346c8e636eb85e65a4f4db
SHA2567c88455d76d375d21f9ee1e4f5b8a2acfc950ae5f1bf22f16df1b593b21bb463
SHA512e8513d585a9a8e9c460945bf9d281646bb3491d227c8bcbb65c876601a12b1bcca8c9dfaebdd31cc3e292133a97496e7765747de9b7b6a0d5ad9ea7b145c4db6
-
Filesize
135KB
MD53468128a22e5cca4282b9801dbd90073
SHA1995fed31956e2b5307027e9a9ee562f5f485d111
SHA25639a810a5d61dc6e88e2b9023f090c223485bd900c33ceb603173181867eedbff
SHA512ef7a4b02825eec72033483f1ae9e241beacb5bd9179ed3c50a85e4247378eb60d11b6e9d8eba09afa6d7943819c9d18b7760d73c1e1096df36ba5d3da282c462
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB