a217b4f3b051b2f062c024bc196fe46127dbe547e67253301167aeb3692d1b93

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe
Size

97KB
MD5

af33435b5bdcf84624980370678970e0
SHA1

3aa853f31ba0a42ca83de69432a1639e1cd89b23
SHA256

a217b4f3b051b2f062c024bc196fe46127dbe547e67253301167aeb3692d1b93
SHA512

5763b09362cf4f5d5284f7c9affab31f8e7aefb485ca9ba63b9d7aa5fc41ffb8cdd54d29bc7940c23b4743fe63797e42ee6562704d686e1c69a63bd9e98bf06a
SSDEEP

1536:jxDDnd1Raqq2uBNdSCM+YTjipvF2PKIu2q:jxDDd/VjIDnM+YvQd2P8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2468	hcbnaf.exe

Loads dropped DLL 1 IoCs

pid	Process
2740	af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2468	2740	af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe	28
PID 2740 wrote to memory of 2468	2740	af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe	28
PID 2740 wrote to memory of 2468	2740	af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe	28
PID 2740 wrote to memory of 2468	2740	af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\af33435b5bdcf84624980370678970e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
  2⤵
  - Executes dropped EXE
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hcbnaf.exe

Filesize
97KB

MD5
fb38ecd9155c89b66fadf3af129f7911

SHA1
8e909f6deff65c1e3a14f26bef4659b5657a5cdb

SHA256
0e47fde2b76326c67a0d75a66cfd7935157a17dd9fadf3f83f0c6a6de46fbdec

SHA512
9aa8b77c2a72e3422a4968f35540630668cbac0c35258866386e317a5c38e71837d8504418d3c301b3b26bd68bd044b0e4fdc3887674b1f49183d2f9fb4ca47a

Download Submit
memory/2468-8-0x00000000000F0000-0x00000000000F4000-memory.dmp

Filesize
16KB

Download
memory/2740-1-0x0000000000080000-0x0000000000084000-memory.dmp

Filesize
16KB

Download