87d54a8210ba4ea526d09962f63fd7ad1b1e5456e3f686c256e2e6879dd473fb

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe
Size

20KB
MD5

b21ecbe633629d4660772866e5283b10
SHA1

7bc553da9f23b6a15c3f326ef637c2dc9127ebca
SHA256

87d54a8210ba4ea526d09962f63fd7ad1b1e5456e3f686c256e2e6879dd473fb
SHA512

5d90e1ff0e73f397111e0538ce0827e7e95cbfc0eedb7025d91a59e4b3c51261979a79f5a27b5fec0a70a96f5a51b243d411555ed10258d264da2608886a77a6
SSDEEP

384:606gWGemxvxyaeEy7yjDIfAMhAvEoJpFLxI3ch32YYurR:3Wd0cf1hAvbhxGdYVt

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2300	budha.exe

Loads dropped DLL 1 IoCs

pid	Process
2944	b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2944-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c0000000155f6-5.dat	upx
behavioral1/memory/2944-6-0x0000000001E40000-0x0000000001E4A000-memory.dmp	upx
behavioral1/memory/2944-11-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2300-12-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2300-16-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2300	2944	b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2300	2944	b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2300	2944	b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2300	2944	b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b21ecbe633629d4660772866e5283b10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
21KB

MD5
51b9188d68f91aae501e60a714cf6b53

SHA1
7f3404b1e4ed463126fd0e786de2b912441b8b0b

SHA256
ce622c4289f0db656a5a31cb6f58e882f094607524437079e59c6ae1ada909fd

SHA512
ef6f06799fda3797da5a45e0d190030be0da1cc04bd617315a6b3ef01396fa83d4a4013325561e96ad06557165735edd08e41a6119ce252e5eeb7e3795518090

Download Submit
memory/2300-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2300-15-0x00000000004A0000-0x00000000004A7000-memory.dmp

Filesize
28KB

Download
memory/2300-14-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/2300-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2300-17-0x00000000004A0000-0x00000000004A7000-memory.dmp

Filesize
28KB

Download
memory/2944-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2944-1-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2944-3-0x00000000004F0000-0x00000000004F7000-memory.dmp

Filesize
28KB

Download
memory/2944-6-0x0000000001E40000-0x0000000001E4A000-memory.dmp

Filesize
40KB

Download
memory/2944-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download