Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 13:21

General

  • Target

    e070a1d6a67dd4c45b7ba096e3514e00_NeikiAnalytics.exe

  • Size

    74KB

  • MD5

    e070a1d6a67dd4c45b7ba096e3514e00

  • SHA1

    c72028fbbb9c7b271773b503ddd5d7780226fe41

  • SHA256

    7074b85c9fc95e4ec2b043127e8611966d31b819a83d53599632be30fad778af

  • SHA512

    b4f803ea57c47aed90d2456f25b6ebd59b184357d86381a6f26b272f75a86243214e3723a364d8c836213e7f70130e640d176cd136f0c18fe2cad45be0377785

  • SSDEEP

    1536:53Bi77wAlPQzRssMm0wlm0yQzRssI1bOJPqnwHzc3VGu53VUYxC7Cvn39IYMRNbT:53Bg1lQzRssiCyQzRssywHzc3VGu53Vc

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e070a1d6a67dd4c45b7ba096e3514e00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e070a1d6a67dd4c45b7ba096e3514e00_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Users\Admin\AppData\Local\Temp\kdwco.exe
      "C:\Users\Admin\AppData\Local\Temp\kdwco.exe"
      2⤵
      • Executes dropped EXE
      PID:2060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\kdwco.exe

    Filesize

    74KB

    MD5

    c2d555c8fc3e3a342590c5c4987f8dc6

    SHA1

    946fbfe97c82777cdecfcfec74ebbec77ce331cf

    SHA256

    b426e9605358cbb6d9765e8de10648ab10abcebf2c61a74713cce723887deecc

    SHA512

    5f09849e6ccd61e74952bb870f9f816f41d4dd9c88096bb2db12bd7c8c0dbfc2ffd3e4dcf9b108d83259427bb15cb1cdd906ed0fcd840bc52980ab5c3591f441

  • memory/1704-0-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1704-2-0x0000000000401000-0x0000000000403000-memory.dmp

    Filesize

    8KB

  • memory/1704-5-0x00000000034A0000-0x00000000034B2000-memory.dmp

    Filesize

    72KB

  • memory/1704-10-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2060-12-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2060-15-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB