Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19-05-2024 21:40
General
-
Target
412a9dd0f6c9989320e86e2e85d84520_NeikiAnalytics.exe
-
Size
135KB
-
MD5
412a9dd0f6c9989320e86e2e85d84520
-
SHA1
6684e00ceb5925c32a4592a95d2d2f7218dd47e1
-
SHA256
37859bac6043c36e43fcb9f81bdbcb8a811a30a820b1febd2f9bf0551989d9f9
-
SHA512
ce1cb04cecc27422aac00284de01db2049e0d414f4a54070a4863b0628c4db127dc041a24c15e689cc80daebe21eb0398a6799a911ede319585c3552b7768eca
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVd/3:UVqoCl/YgjxEufVU0TbTyDDalv/3
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\412a9dd0f6c9989320e86e2e85d84520_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\412a9dd0f6c9989320e86e2e85d84520_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD555aa16e7b0ca92e4334fc3f6613426e9
SHA1b4b558eb4342f1505c55712e2b2ecdd794e810e9
SHA256c82a37c3e2c145100aa24e8d4b17be050ba218b7d7a03692fb157bc8eac92757
SHA51224796e4a0b0dcbd67ad536d49237fbb1dc37fab5181cca37656dd4f61cbebb7cf8f86d5aa908b18cf3943c556bef3267fead961464d782694acb0a18bf5a07eb
-
Filesize
135KB
MD5292517a9484b9e8739e99173f4933ff6
SHA1111ccc005f2c790d439fe897d7e4ef6725cc4e77
SHA2569133926c310ab28e345367d347f6b61e8bc65a4b2f4642d5e72b7c5e127960c2
SHA5123ac837b02432d762d5d552e9e74a1babe776309f91029a2c24de2e7b8850e532ee7fca2d40271cbd579da68ac4d58218e6df249ce18072580b6c522644c33975
-
Filesize
135KB
MD5f7eace2898cc536a3c22c399d811807b
SHA1a89da94724fd6d6b7d9c60b96108af576acfed7e
SHA25686b45370a8daf663aac987d3d4d6b0b7ea24502a086ed0701b2ec5fb2ecd8519
SHA512ed424acf73271e3ac08ffde5d98fc5de804173ca06bede9975d7ef234004bf698dbdb3d0b881796da497266568471f93022c0d6dd92ad45dff2bc601fdb851ad
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB