9d7c90f1dbe80785eb11d281b9e6a259b9bf1a4d21658c0b9f4cab5ecc24b593

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe
Size

42KB
MD5

4abab0178a9dd0df2685a745337a4eb0
SHA1

c2e3aa20745fc0b5bf1a883e91c952805a205c62
SHA256

9d7c90f1dbe80785eb11d281b9e6a259b9bf1a4d21658c0b9f4cab5ecc24b593
SHA512

bae66b210295875dee97afdf019f2993a1c8bc9da3869e2e0dcbc70a8192997412573e13799cb0dc8435c6fdc4171dc0466c0c8f666dcfcee264206a17a1f5b5
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnY1nP:m5nkFNMOtEvwDpjG8hgpY1P

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2504	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2280	4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2504	2280	4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe	28
PID 2280 wrote to memory of 2504	2280	4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe	28
PID 2280 wrote to memory of 2504	2280	4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe	28
PID 2280 wrote to memory of 2504	2280	4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4abab0178a9dd0df2685a745337a4eb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
50bc75a5004464df3efafee5e75aab31

SHA1
7b3dc2071bac9f5a2c861d3ceeadd8f124fbc30e

SHA256
10c76f03b32bfcfc8b6b518fcf0c9ef503eceb6b54d772ed0c09a28e07f0e7a9

SHA512
5c0f48c6f64211dae1d7c9633456f10986c7e22b253a9e7a32ad279ffa1f7c790f1f71742f3c1c931a9396435f49e7f1c9607302c8ac5adb963cbeffb4b3a90c

Download Submit
memory/2280-2-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2280-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2280-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2280-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2280-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2504-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2504-18-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download