88a8d0586c2fa6a1f3921675dfb35fb4d626b8a5a16d57c1bf3302d03e295e26

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe
Size

448KB
MD5

44d05288f77e0b29b05acdce71bb8b80
SHA1

2b0db3c5a06ee2a628c3b2449003c91ba2b00fe8
SHA256

88a8d0586c2fa6a1f3921675dfb35fb4d626b8a5a16d57c1bf3302d03e295e26
SHA512

301e4c09a4248453721d899668e01a4a6db0ff4e12d73fadaa84014f5b3fd7424a3703ed1ad26ef157c5673e87b9c73232737cd70a01c8b716fbb8cd4c382dd0
SSDEEP

6144:fUORK1ttbV3kSobTYZGiNdnikoh+KiRgRccYqK1kDk0FOL4MtkyOGGKD0GE:fytbV3kSoXaLnxosly2dwD184pYGQdE

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4852	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5108	44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe
5108	44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1676	5108	44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe	83
PID 5108 wrote to memory of 1676	5108	44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe	83
PID 1676 wrote to memory of 4852	1676	cmd.exe	85
PID 1676 wrote to memory of 4852	1676	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...