c5c2ad315ecb44dc38f5e687fa9b8a23023e984ef31d1514cd211e81bccd7ea6

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe
Size

34KB
MD5

ae231849bc431244b466e9016f4cfdf0
SHA1

cb2588d7a5ac1c727d011893b0c7aac041122d05
SHA256

c5c2ad315ecb44dc38f5e687fa9b8a23023e984ef31d1514cd211e81bccd7ea6
SHA512

4602d8d9ff6e6a4e337f3709491a50672448a63af5b8acd5b4c2e2de94d7600feb5ea41d9ec012ccbdba773f0f1d64384b1e0824b508d97d86cb7329498c0022
SSDEEP

768:6B7HBXFw82t2C80lyaZ4jX05Rftleo9LXm4g:u7HZFwzlyaZTNAaG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1792	cnwog.exe

Loads dropped DLL 1 IoCs

pid	Process
2912	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1792	2912	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe	28
PID 2912 wrote to memory of 1792	2912	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe	28
PID 2912 wrote to memory of 1792	2912	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe	28
PID 2912 wrote to memory of 1792	2912	ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\cnwog.exe
  "C:\Users\Admin\AppData\Local\Temp\cnwog.exe"
  2⤵
  - Executes dropped EXE
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cnwog.exe

Filesize
34KB

MD5
2afac02dcab6e571bd39d1652784c170

SHA1
a81eff8dd648c0daa43cba77cf6daa3d9cb2cd69

SHA256
d52d0a7b1e6ee05a6badc04d4b271bb59588c906c1423a0545178abcb5f91a8b

SHA512
d51c635c2f506d68022d5b4602da478bb956d44db06728de7cb86c03c81fc2008a109f5d9db136ae9a52ec22c0849e1986b3a376d3264d4df359d0da007d4368

Download Submit
memory/1792-8-0x0000000000140000-0x0000000000143000-memory.dmp

Filesize
12KB

Download
memory/2912-0-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download