2018d6952c057a21cf55318d6aa22871daf2916c655848bffcabfc092e3e03e8

Analysis

max time kernel
5s
max time network
20s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4845aa93c6412074c917053cda175170_NeikiAnalytics.exe
Size

63KB
MD5

4845aa93c6412074c917053cda175170
SHA1

6030c1ed31c08f2b25ba5f7f9d0e577216124467
SHA256

2018d6952c057a21cf55318d6aa22871daf2916c655848bffcabfc092e3e03e8
SHA512

dbde0759f5eb605c7169215a434ccea75b1dc07ad5e3f7beba9d3461fc7877c0b415f4d74fbe3958675f9254a27b3d8cefc1e043490d12ca7f58ab6e2d2bf772
SSDEEP

768:TOSEWgI6sRJ0QPk5Cd8NUIu0oWsV1qaZIp/Bj7YcRpaSOovHYxtxdvO:Sf9Uk5CdzGs1stvHYxtH2

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1564	yauim.exe

Loads dropped DLL 2 IoCs

pid	Process
2172	4845aa93c6412074c917053cda175170_NeikiAnalytics.exe
2172	4845aa93c6412074c917053cda175170_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2172	4845aa93c6412074c917053cda175170_NeikiAnalytics.exe
1564	yauim.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1564	2172	4845aa93c6412074c917053cda175170_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1564	2172	4845aa93c6412074c917053cda175170_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1564	2172	4845aa93c6412074c917053cda175170_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1564	2172	4845aa93c6412074c917053cda175170_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\4845aa93c6412074c917053cda175170_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4845aa93c6412074c917053cda175170_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\yauim.exe
  "C:\Users\Admin\yauim.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\yauim.exe

Filesize
63KB

MD5
377d172871f20c4e8b74bfb2c774475a

SHA1
139652f01b256d1da9d95271813fa3f18e6df699

SHA256
c579aeb66840766c8f885c14b76b1f829524f7cc149cdaf7949803cc955de489

SHA512
bd632170228bab5126bcf8199e9729237531654fba1aefbe418a3668dbb83acd44e234c4886301d55905ad3aa5ed558f363ce9051206f50f079a3340d222cd57

Download Submit