df91130fb753b1913084c3244c3f56e1a827ef2065d22815425623f0dea74d68

Analysis

max time kernel
23s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe
Size 505KB
Sample240514-3ztpfafd99
SHA256 df91130fb753b1913084c3244c3f56e1a827ef2065d22815425623f0dea74d68
MD5 4880fb4d393e60bd03f884157a446950
SHA1 54d4854f0a785b6ba83b4eb0c5cd4d6f98e7d2d8
SHA512 bf462eabe7d769e3a8232c7293c18dcf3df35c509c650d72fb4196119adefdb5c80ab6c09947f11a8dbbd4e2692d3fb1771aa3002e7b7086d9028ac0090367ea
SSDEEP 12288:wlbd+b1gL5pRTcAkS/3hzN8qE43fm78VE:Wbd+G5jcAkSYqyEE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2540	MSWDM.EXE
1988	MSWDM.EXE
1052	4880FB4D393E60BD03F884157A446950_NEIKIANALYTICS.EXE
1032	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev4239.tmp	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev4239.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	MSWDM.EXE
1988	MSWDM.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2540	1328	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe	82
PID 1328 wrote to memory of 2540	1328	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe	82
PID 1328 wrote to memory of 2540	1328	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe	82
PID 1328 wrote to memory of 1988	1328	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe	83
PID 1328 wrote to memory of 1988	1328	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe	83
PID 1328 wrote to memory of 1988	1328	4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe	83
PID 1988 wrote to memory of 1052	1988	MSWDM.EXE	84
PID 1988 wrote to memory of 1052	1988	MSWDM.EXE	84
PID 1988 wrote to memory of 1032	1988	MSWDM.EXE	86
PID 1988 wrote to memory of 1032	1988	MSWDM.EXE	86
PID 1988 wrote to memory of 1032	1988	MSWDM.EXE	86

C:\Users\Admin\AppData\Local\Temp\4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1328
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2540
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4239.tmp!C:\Users\Admin\AppData\Local\Temp\4880fb4d393e60bd03f884157a446950_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\4880FB4D393E60BD03F884157A446950_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:1052
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4239.tmp!C:\Users\Admin\AppData\Local\Temp\4880FB4D393E60BD03F884157A446950_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4880FB4D393E60BD03F884157A446950_NEIKIANALYTICS.EXE

Path C:\Users\Admin\AppData\Local\Temp\4880FB4D393E60BD03F884157A446950_NEIKIANALYTICS.EXE
Size 505KB
SHA256 8eb4ffa0da678d69a70f300d3ece18a1929f506d07dc8428e2b3d398fc9c6720
MD5 14778462c14ce071671da7329599dfed
SHA1 05b3069c6967563054d212b75859b05dabacfab0
SHA512 9c41bebbc1f78749fceb71f79d98eabcbbc97898e5a3eb65458abdf3d5850a8e809ed50a0dfc288ddfd268c2d418eebb4ce3ad2fb10fc30e0312796dc6019c07
SSDEEP 12288:wlbd+b1gL5pRTcAkS/3hzN8qE43fm78VI:Wbd+G5jcAkSYqyEI
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 47KB
SHA256 685ff783e760bf7ecffd7f2cf55e6f30d979703b7fa5e1138642c85d9741ed46
MD5 5f8d409983914065297cec4d27496caa
SHA1 8cf39ec61445061b7642d36613de97c12850d821
SHA512 b83a4763d6dfd579cac7960d623d7a94e0b4b9c5b12a58ba0f2422d71fdee2d97d8a7f163b12f2441273471d26389e885ff944ab3f27b78e8af36e6f8beb853c
SSDEEP 768:HPNX6ls+G1H6HGg+siyj+dIni6psydADsOj33G2FsdqmPnuSnM58lT+sQI:Hlqls0GgUyj5JxdA4Oj3W2Fsdq4FMG+s
MD5 SHA1 SHA512 SSDEEP

Submit Download

dev4239.tmp

Path C:\Windows\dev4239.tmp
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1032-21-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1328-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1328-10-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1988-12-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1988-24-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2540-11-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2540-25-0x0000000000400000-0x000000000041B000-memory.dmp

Download