9f8a692f4795ea939d042c9914952b7c1782ab54d0f9c88c3fe4a60556be98a9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe
Size

25KB
MD5

d25fa79d16af84d3f61d66936f02ac90
SHA1

46cad828fed51ddfd3b919a6f5e2b231b32a6a8f
SHA256

9f8a692f4795ea939d042c9914952b7c1782ab54d0f9c88c3fe4a60556be98a9
SHA512

713decadafb32aa60502bd91e25290354fc821abcd7c76bc4dbeddfed3edcf8a919d9cfbbccb84fe0cb6b74f08f4d3c3bd8c8a4cd41a5c398b2d12f1111abcdb
SSDEEP

384:0wznxkW5jElj3Jb7IdLEwcFq2jAiOCTJOcQTws61:lVE55/IqFq2s1EJO3j61

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2972	budha.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2972	1964	d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe	28
PID 1964 wrote to memory of 2972	1964	d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe	28
PID 1964 wrote to memory of 2972	1964	d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe	28
PID 1964 wrote to memory of 2972	1964	d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
25KB

MD5
9060bfcd36ac991a4a875e5edaaa8b01

SHA1
5166823eb9c9a87869f6a16350e3551f193dc121

SHA256
faaeaf8a005698885a3c6f56d9ef626cab2a879a27338d9ac0a2de9d8554a331

SHA512
e99fd9409643fa65efb5d71e0817fcfb03f8fe2b16bcddaeece7b3490a498b473a068a3e604ce934aac83b1e65e1b33bf7e3d071841a9af14eeacb534550afed

Download Submit
memory/1964-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1964-2-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download
memory/1964-3-0x0000000003510000-0x0000000003910000-memory.dmp

Filesize
4.0MB

Download
memory/1964-7-0x0000000002B10000-0x0000000002B19000-memory.dmp

Filesize
36KB

Download
memory/1964-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2972-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2972-14-0x0000000001C10000-0x0000000001C11000-memory.dmp

Filesize
4KB

Download
memory/2972-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download