9ffe15991f0c99f80d72ffe3d5d573407fc6aa4ef62d28d03357cbc22cd574cb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe
Size

31KB
MD5

d721953e4904b65f2c9262fc7d229970
SHA1

3a833a0c1000b88db5f576810c29991bbc3ad749
SHA256

9ffe15991f0c99f80d72ffe3d5d573407fc6aa4ef62d28d03357cbc22cd574cb
SHA512

b3baf21aabb1a96d65d5b1a01a324de6f3474f3a5411a6da6bf9eba710c54edce2e2bf8d7f1bbb48fb012835a2365d966259b11b142909f7ad8a65b045ca0324
SSDEEP

192:KlApk98m4e0/IDJh/5ZQcvoyne4t/PQ3Pw1C0SluWbiWBNEckcVhJriEc9ht/Rbt:MApc8m4e0GvQak4JI341C0abnk6hJPHG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2196	sal.exe

Loads dropped DLL 2 IoCs

pid	Process
1720	d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe
1720	d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2196	1720	d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2196	1720	d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2196	1720	d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2196	1720	d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d721953e4904b65f2c9262fc7d229970_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1720
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sal.exe

Filesize
32KB

MD5
a6239ddbd14cf4a37c259b536cbaae61

SHA1
fb7adbe59f52e6fda362b0af6fee0ff5787c94ac

SHA256
66245d499d8db6ea71893bcf1dbfd443d2d2984ab0fe9bdbcaa4cb52fffcec66

SHA512
ad3323a3c583ce209f39b64c96565bb560f2357a8572241d433e37cbf9e8d5cf6d78da2bb4138c845e10850a213c947e82a313c975caf4f0cde0da697a27d2a0

Download Submit
memory/1720-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1720-4-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/2196-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download