9dee91c62cf35196e21f75a643cef1cb13eab28b7698c9827cbf8c014c7373b4

Analysis

max time kernel
8s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe
Size

38KB
MD5

d4e776245d334c79b5dd8bdacb58dc10
SHA1

a73c3649f35f95b6df1007c3c1068c0554370eb3
SHA256

9dee91c62cf35196e21f75a643cef1cb13eab28b7698c9827cbf8c014c7373b4
SHA512

28a590526bb6faf3e34cb2349010a83c37865a0ff2591a3ef62782aac5d1070a501ae692307b679de987a419d4e14a830f95e8ea59cd25c474951210600f4396
SSDEEP

768:2mdB+lOuTHTb3JjOtdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsiZ+T/QYsuRCs:ndostdgI2MyzNORQtOflIwoHNV2XBFVd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	ffengh.exe

Loads dropped DLL 1 IoCs

pid	Process
2408	d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2408	d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe
2356	ffengh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2356	2408	d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe	28
PID 2408 wrote to memory of 2356	2408	d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe	28
PID 2408 wrote to memory of 2356	2408	d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe	28
PID 2408 wrote to memory of 2356	2408	d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d4e776245d334c79b5dd8bdacb58dc10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\ffengh.exe
  "C:\Users\Admin\AppData\Local\Temp\ffengh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ffengh.exe

Filesize
38KB

MD5
5d8d8225d5eb034c92e835c1827badc7

SHA1
23d0b13c0e9f6c5df94b8822f3c628bc276a4411

SHA256
5c25f61803d92b0eeb6537adea6890d437c8ea5ac3f094093074463e29a1b9f4

SHA512
b56a9fe6ae719d9b18fc839c83fc4030ee268c1f353b226e68e9869aaa940906df96b43edf34f4f0b2d10a8e0b236b6c9907b7f29156aeb44c6de2df4262b240

Download Submit
memory/2408-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2408-1-0x0000000000230000-0x0000000000237000-memory.dmp

Filesize
28KB

Download
memory/2408-2-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2408-7-0x0000000000230000-0x0000000000237000-memory.dmp

Filesize
28KB

Download