Analysis

  • max time kernel
    24s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 14:29

General

  • Target

    e20378233e152e294187c52de5607850_NeikiAnalytics.exe

  • Size

    538KB

  • MD5

    e20378233e152e294187c52de5607850

  • SHA1

    314a4f7f1284c18a48ff6ba08a4b5d87288bd15e

  • SHA256

    e7b8b8eb6306809f9eeb2a092f8b3582eb735791b7896d7fdb00e8a7f65689e1

  • SHA512

    92936641c5864311a6858207d6bf08b5d0bcf562c56c35ebc83eb3b4a20d8107922f561fa1770d6b7a79d3410ff19349604d18e332dfbf9ac330e042cf3fe9a3

  • SSDEEP

    12288:wlbd+h1gL5pRTcAkS/3hzN8qE43fm78Vb:Wbd+w5jcAkSYqyEb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e20378233e152e294187c52de5607850_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e20378233e152e294187c52de5607850_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:5024
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\dev4844.tmp!C:\Users\Admin\AppData\Local\Temp\e20378233e152e294187c52de5607850_NeikiAnalytics.exe! !
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:100
      • C:\Users\Admin\AppData\Local\Temp\E20378233E152E294187C52DE5607850_NEIKIANALYTICS.EXE
        3⤵
        • Executes dropped EXE
        PID:4644
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\dev4844.tmp!C:\Users\Admin\AppData\Local\Temp\E20378233E152E294187C52DE5607850_NEIKIANALYTICS.EXE!
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:4104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e20378233e152e294187c52de5607850_NeikiAnalytics.exe

    Filesize

    538KB

    MD5

    167795774589f49c6c93b1d6b0917f19

    SHA1

    b57a2a54b3e45c230b0235edf2dddfee09803e67

    SHA256

    20d3b78985981d335986635474719d6b95d3a3f19a85afe8a04a5407deec854a

    SHA512

    7ea4d0c1350c41759b01c155eb8fd229c6128d232f6ca1110ac902adc73a351e45b2becd4ac51bcdfed0b53a26e1dad990083e2cadebd925b0fa67b526dbe8aa

  • C:\WINDOWS\MSWDM.EXE

    Filesize

    80KB

    MD5

    ca1665aebc386a9e1e00e62a6f24bccd

    SHA1

    ace8a60b685b6e870d0952fd7de8b1157112db6a

    SHA256

    9a7574d09ccc52c090ac586db59b15f7295fb15f6c2a1492558cb6d4cfdd5d3d

    SHA512

    bd227870c2e6b67e11e532e43aecdd0af65745a31cc0beed86032bb00879a3eddeb9ddeae7bcc7089fee758179e2b7b9f567957f7f2fcfc69ed766d5feaa6d17

  • C:\Windows\dev4844.tmp

    Filesize

    458KB

    MD5

    619f7135621b50fd1900ff24aade1524

    SHA1

    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

    SHA256

    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

    SHA512

    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

  • memory/100-23-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/212-0-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/212-9-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4104-20-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/5024-10-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/5024-24-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB