962a513f02a2b9e120212003aa2a72b138e0f185305011f193db36f26b9ae416

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe
Size

31KB
MD5

d7e287208c41f1020f8099b025529a90
SHA1

c8e6e4f384444b781d89116559e78361373d7236
SHA256

962a513f02a2b9e120212003aa2a72b138e0f185305011f193db36f26b9ae416
SHA512

63a2ff336196fb8f96616aaaf49fac66ccfcf74a1fae844a53bd8f297b3ce3e37dcb2cae1d9b75d589f1f5e4d8de8d7115c147f5536315cc3d0a228813edfc70
SSDEEP

192:KlApk98m4e0/IDJh/5ZQcvoyne4t/PQ3Pw1C0SluWbiWBNEckcVhJriEc9ht/Rb1:MApc8m4e0GvQak4JI341C0abnk6hJP+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3064	sal.exe

Loads dropped DLL 2 IoCs

pid	Process
2268	d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe
2268	d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3064	2268	d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe	28
PID 2268 wrote to memory of 3064	2268	d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe	28
PID 2268 wrote to memory of 3064	2268	d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe	28
PID 2268 wrote to memory of 3064	2268	d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d7e287208c41f1020f8099b025529a90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2268
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sal.exe

Filesize
32KB

MD5
dc698652b31792387847b244f8dd59b6

SHA1
867df654154ad5c1662bba68545326cc0e82849b

SHA256
1f6de1ee7e7b016ca6d71d7c9d9bd53f71f22ff51b26db5956d87658936094ea

SHA512
b167e1953a14718f7046020af5632c26e3d1f6ba1f54830e3624bbb5899a6bba603e9642e364f163949a283af238cad9891f902cdaad5b8e1d5e5340837aafab

Download Submit
memory/2268-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2268-4-0x00000000003D0000-0x00000000003D9000-memory.dmp

Filesize
36KB

Download
memory/2268-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3064-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3064-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download