Overview

overview

9

Static

static

3

edb5a7724b...cs.exe

windows7-x64

7

edb5a7724b...cs.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 15:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    edb5a7724b86d9189d5c6f1de58c0990_NeikiAnalytics.exe

  • Size

    403KB

  • MD5

    edb5a7724b86d9189d5c6f1de58c0990

  • SHA1

    693e7225f542ab2e9960c605549352f10df4b524

  • SHA256

    ad5ab131073a9abde0f2133d3d3a73b8cfd236f8bf42f2b616b9eb676fe5efe8

  • SHA512

    7d7824c9cdb869a62c69eff0336c37cb93837cbc9f436850ee6fd861735db6c7f588f0fbb9a8111110cfe518ba341eda46e786a419ce5216823b5f70e2ed104f

  • SSDEEP

    6144:RqKvb0CYJ973e+eKZ6gXFTlAOB6pcq+HpFeHPgsHsSYafq8g2OA:vvbxYX7Z6gTAzpcqapMvgzS/J1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edb5a7724b86d9189d5c6f1de58c0990_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\edb5a7724b86d9189d5c6f1de58c0990_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:1500
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
        PID:2684
      • C:\Users\Admin\AppData\Local\Temp\_ConfigSecurityPolicy.exe
        "_ConfigSecurityPolicy.exe"
        2⤵
        • Executes dropped EXE
        PID:2248

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_ConfigSecurityPolicy.exe
            Filesize

            304KB

            MD5

            a2ff144973a98d241d129081fa9baa6b

            SHA1

            7db942775d84fe782e85390c0ddd1b1ef61617b1

            SHA256

            1cc8e44c620067448bdd2fa88f9ff3a3c64b9a3f06b51c4116ab73376a48bc0a

            SHA512

            c71abb7c0ad554d5f1a5e324163763c6ff5476d37145092c69f213973278c7899818a3809a80323184eaedcbd45f9f5a6acd73d776dc617d32ededc89f84a303

            Download Submit

          • \Windows\SysWOW64\Zombie.exe
            Filesize

            99KB

            MD5

            32493fc260ed8219dd94ca8e84d1820f

            SHA1

            c12c157ea491af1df7fea3c5f6a7dff381d392a8

            SHA256

            81c626ab2c9fcfd108837c2814e0ab8d711455cb70de7117e1f1032ee3761bf1

            SHA512

            643dc86298275f2eaa222c35e58bae570198b0f180567271df2a070ec253fe8bc99f816c5b6ef89b54f3e0ce9910cb367534546331d299c64a5789ad8ee4e87d

            Download Submit