Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 10:22

General

  • Target

    b254fc8144e93fafc5e3bdab1cc94f00_NeikiAnalytics.exe

  • Size

    256KB

  • MD5

    b254fc8144e93fafc5e3bdab1cc94f00

  • SHA1

    eb213621f16d418ecb687be9b13c3344ce715b1c

  • SHA256

    245fe448bbd5a16b56c50c42819d9f475a8c27b51ccc08858d61121d1161a4f1

  • SHA512

    b0aba02c5d613f5e058b5fef630e15cab01426e74181e5aaf7772a7a51611fc1a63268a3350a55c2ed397fee67e1c1457e3fbf1cb8a77f491c39601c2edeb5c1

  • SSDEEP

    6144:1vg98eNTb/UoKHU8iN2iYty5Y+tG91K09YEuOFcU0b:1vg9JxVSU8iN2iYty6+tG91yEuOdq

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b254fc8144e93fafc5e3bdab1cc94f00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\b254fc8144e93fafc5e3bdab1cc94f00_NeikiAnalytics.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\xouafa.exe
      "C:\Users\Admin\xouafa.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2068

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\xouafa.exe

          Filesize

          256KB

          MD5

          40dc4ac6b048bf44da4a33bf6de103ac

          SHA1

          f08484bb0c0cef1290357e0092946ec936448078

          SHA256

          68d021f61b445df7b3a0dfc7c640eacb5ac8f2aa4b27a3c3dd1a06b4badabf6b

          SHA512

          646218d1c74e21d5cf3ac61230e118097db084da10aa684985abe045ec105c2f1eec3f808a38a8045ab9e9563eab4acac43ae701a3a182dcbb84b3e97db1c561