e63674e4a3976d50e41b6184e9681b1a0718ae723b4fb42eb4d2fd4cb876ef0d

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd3ad3338dc8c0343c029f7ed8f333c0_NeikiAnalytics.exe
Size

329KB
MD5

bd3ad3338dc8c0343c029f7ed8f333c0
SHA1

761ea5157e35d0c31798b588dcb2e7b8caf3d446
SHA256

e63674e4a3976d50e41b6184e9681b1a0718ae723b4fb42eb4d2fd4cb876ef0d
SHA512

2e75b5c3cf1bf0995bdd39ed7383e8e51b1980862ca19304849e497db4dc7a0d62db250d731f7fdd752d2ba9d9d46f1ee52f91ac3def10e0505abb0e7546150e
SSDEEP

6144:+8vcLy75hTIEqbK4b8H0Rlp8oHcxXpubG3ELTFTYwg04U7B7A070gy7hZSXKbiUa:+Zy75uEn4gUbp70pubG3u+j270gy7jYR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2448	13-06-07.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\13-06-07.exe	bd3ad3338dc8c0343c029f7ed8f333c0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2448	2772	bd3ad3338dc8c0343c029f7ed8f333c0_NeikiAnalytics.exe	87
PID 2772 wrote to memory of 2448	2772	bd3ad3338dc8c0343c029f7ed8f333c0_NeikiAnalytics.exe	87
PID 2772 wrote to memory of 2448	2772	bd3ad3338dc8c0343c029f7ed8f333c0_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\bd3ad3338dc8c0343c029f7ed8f333c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bd3ad3338dc8c0343c029f7ed8f333c0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\13-06-07.exe
  C:\Windows\system32\13-06-07.exe
  2⤵
  - Executes dropped EXE
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ns1.JPG

Filesize
26KB

MD5
5d55dc8e0709a373ed3cb0c1d9f4b3c0

SHA1
b7831a291b84f1957058054fe971eda8580b270b

SHA256
766a8c5162c8f1c57163a019cb55cdef10997ddf06fded1aa1aace6fefd0b2fc

SHA512
c96f11d20e7f62c9270e0b78edcd6fd9aebb597b4a2793a846e93f13f50fa135efd35f05e8164b4aeacf4b6b139b6a72ed4f807e7d3a076b5acc30a4bf2426a9

Download Submit
C:\Windows\SysWOW64\13-06-07.exe

Filesize
291KB

MD5
6acdc81e9bb26daa1ed7410c2d11c54b

SHA1
d46bc91307e6b3ede1a58393f53dbc3cfa212a9c

SHA256
9bd2d63f5daa57167876761e7676bddef9a79276b9b3c78634e680a0a7c12dba

SHA512
d9b6b008e23a8af45b78bd811b94eb0f3cfb850ae431a84be0bc8f592560bf191f53ef61966bbe108449eb8e7827c0e50305d31368752b2e0a3bdb7cf4c2c8d5

Download Submit