78970bac5f013a47f4ee06381975b39349e5ef95b2b1c8d4718e2aca7bcf05e2

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
Size

1.5MB
MD5

bbe4de499e11f5843fc34beeb68ec030
SHA1

c72a702a35c643460b92306949dbf8078bf5e25f
SHA256

78970bac5f013a47f4ee06381975b39349e5ef95b2b1c8d4718e2aca7bcf05e2
SHA512

efadff8618abfb720363329d12035361e36c585a44c8909350277ee94d41fd441ee4996340625309adc7d8636e4aa587b14c0acbb8a6670b7dc566a25e2b7532
SSDEEP

3072:hR4jdNqTqHL+3phRrbhqkBSBJmKbgeVMMZC9NbcObtvCmXlwi8MM87cJc4vcqc8j:PafYphSe+dbjMMqcXmr8MMtjyhX9+FLh

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\G:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\K:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\L:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\M:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\H:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\I:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\J:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\N:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened (read-only)	\??\O:	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX660.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX698.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX685.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX69B.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX54F.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX70B.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX672.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX686.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX70C.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX562.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\readme.1xt	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX620.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX70A.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX674.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX675.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6FA.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX560.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX561.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX54E.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX687.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX69A.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX563.tmp	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	1680	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2248	1680	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe	28
PID 1680 wrote to memory of 2248	1680	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe	28
PID 1680 wrote to memory of 2248	1680	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe	28
PID 1680 wrote to memory of 2248	1680	bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bbe4de499e11f5843fc34beeb68ec030_NeikiAnalytics.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 740
  2⤵
  - Program crash
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.cab

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.5MB

MD5
4813a9e0a3750df4efc35f2cd8209063

SHA1
bad11778b7b1daf81b7a54cb4ff77c249aeddc06

SHA256
bf25e1c453e251c313ac2dee594d2219fc837deb66cd0f5fe3c98a61e1fe4c2b

SHA512
73d8fe7792280f5d76d73213b242afcfdd0606cfb7b6c9234ea77653a6ae70b95b01d826ae1c491f866222311c867e06cd47e196942c671604885b38c2430f7b

Download Submit
C:\Program Files\7-Zip\7zFM.cab

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

Filesize
118KB

MD5
f45a7db6aec433fd579774dfdb3eaa89

SHA1
2f8773cc2b720143776a0909d19b98c4954b39cc

SHA256
2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

SHA512
03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX61F.tmp

Filesize
168KB

MD5
c40cd71c7601387b53c0e59d62880d1e

SHA1
9b09305e0cb7a85c823d514d9dd1e2a431c8a5db

SHA256
90da536777201b8bffd0c2667e3cf8c1781eba777c010e434e85e0e0c5d1c0a1

SHA512
fcaff627a38cc412e0c62e2aec0c7ebc04192f3beab642b0dc237eb11722712ed0141d4e8b4d28f03d191ea7047e7647e5c95c04ffd22633fb0333514e2c70e6

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

Filesize
1.6MB

MD5
527e039ba9add8a7fac3a6bc30a6d476

SHA1
729a329265eda72cada039c1941e7c672addfc19

SHA256
4b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94

SHA512
9e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449

Download Submit
C:\Program Files\Google\Chrome\Application\RCX674.tmp

Filesize
168KB

MD5
ffc344275fcf051cf262b73f056a4e25

SHA1
2ca86fe367b19fa276fe83690060c3b85e2df1a4

SHA256
a30df458df1caea66d203d433ab803d5cd2a1a3193d6e4d883608f1d12d14298

SHA512
a4f2c3c611c3291333946e1a4c429457e053c9dd36c7d2a35c6654f0f239b3bab56f1d3c1cdf60956357f843c9942459154520682d5e0aec75732894bcc1c503

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.cab

Filesize
2.8MB

MD5
095092f4e746810c5829038d48afd55a

SHA1
246eb3d41194dddc826049bbafeb6fc522ec044a

SHA256
2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588

SHA512
7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
245KB

MD5
5298baf17c23a3e44784dbd64186aff6

SHA1
2bcd134f90d043399aa13fc44f1a814551f15365

SHA256
c3beaf86b7ce068cdf0058f8a18e7110c3251501bc432ffb94b1420daba5481b

SHA512
b79bbe719fbfc31663fd0c08b00d3db1dfd4965b450e55f4b5497b21dd93494498f87f9e48b9599b698657d055b8f3d1e687437e977536e298fe0a81bfcca063

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
1.5MB

MD5
4059e079106a1c1bf23674527e2430ec

SHA1
00e4eda6df67ffa8d556ee514b3b23e2ede3a8f9

SHA256
16a8f2d3392bebc987a5521e43c07af0c0d99a6bd83ee0af3cd97f708ee4829a

SHA512
3ddf1eae49e62c5ad3a3fdf705d5a3714334345b10e9e812a4b3560a51f65daddcc66e06a1bce6d591300fe7ef994a79d560a163f105e22e1198e2060ce94727

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

Filesize
1020KB

MD5
b65d7344b0a7faa207d2e1a7adaafb60

SHA1
755ad15b1745b0e730d658d4a92e2b754425b7db

SHA256
f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92

SHA512
f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22

Download Submit
memory/1680-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1680-209-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download