49bb0e1fde956f70fd06d4a2743aab5f5df1586a2f1d2c0e6973e00362be9808

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe
Size

32KB
MD5

ba4f070e1b6570ab64a012d03f2e8d60
SHA1

1a0f2eb40ee67f785b46bafc9180a1afd7d6f0a3
SHA256

49bb0e1fde956f70fd06d4a2743aab5f5df1586a2f1d2c0e6973e00362be9808
SHA512

b7bf61d23bff528ac2fd31d74ecd38839869932f3d9136105b9c729857c6332af6a89be96102985397db513bd84061fa20ee75ddb53c2f6a3c122233d5981a00
SSDEEP

768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhC:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYi

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4748	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4748	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4748	3320	ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe	81
PID 3320 wrote to memory of 4748	3320	ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe	81
PID 3320 wrote to memory of 4748	3320	ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ba4f070e1b6570ab64a012d03f2e8d60_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
32KB

MD5
2a9a1af080fc6c6f30b0c0da0b4f2910

SHA1
9576fcbfd23775dd741ccedae3bcc5564cb6d251

SHA256
c44e38ac1d85e827bc1dba44adac981204ff10c17792583826cd5bb75829b206

SHA512
bd149708c3dbf48726d764d46f1b993496f5d0ab71d6783c67d58c3535588bd7d33562340540dbbeaf6926cbbdb5b3124eff93a0e67255be04ec6351f79d2fbb

Download Submit
memory/3320-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3320-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads