9fe247f71c6884277fe5a2a0e14f1040b31864e5d84b176a0a7b8cb3efbf8334

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe
Size

66KB
MD5

0f324767a7ea012c57d5d8015895dfa0
SHA1

252a52c634fe21539850ec1bd1c4d039cf73d5e9
SHA256

9fe247f71c6884277fe5a2a0e14f1040b31864e5d84b176a0a7b8cb3efbf8334
SHA512

39e4363db481740c07c9264a57dd26122a57553d5600fe51887d7ca57940b55558b323d1fee1a6738f0883542011599671d01b797e0efa7b5b01d6be93e47348
SSDEEP

768:ArOb1QF5kMtFC9LuryNzZHvAe5d/LfWOf01+tLNQGVAbOuf19jbEpDWIajDsXPhn:NB+FC9RntfWeoGiPyCHjKDjfQQQtUegD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2332	budha.exe

Loads dropped DLL 2 IoCs

pid	Process
1280	0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe
1280	0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2332	1280	0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe	28
PID 1280 wrote to memory of 2332	1280	0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe	28
PID 1280 wrote to memory of 2332	1280	0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe	28
PID 1280 wrote to memory of 2332	1280	0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f324767a7ea012c57d5d8015895dfa0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
67KB

MD5
046c7468ac2b8bd50340a0a19fffb2f8

SHA1
37401feb44d832adb96f2c34c19437f02d9e2e2f

SHA256
ff71851ce50f6503d1f8f52ab804f5bb7f029c15b4cdb4f92d7da74c8aee0abe

SHA512
40f49ae806350eb949e0d65cb53dcbc5a12db2d35169be0e86f9f0f635ddde099ad0a92f52c38b43261fbc0d173e12b8ab612e8c1d8f45d38ce004d8e534e280

Download Submit
memory/1280-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1280-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1280-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1280-2-0x0000000000409000-0x000000000040A000-memory.dmp

Filesize
4KB

Download
memory/1280-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1280-9-0x0000000003220000-0x000000000323C000-memory.dmp

Filesize
112KB

Download
memory/2332-16-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2332-17-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2332-19-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2332-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2332-21-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download