Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
19-05-2024 19:09
General
-
Target
1f3513dfc2078c75f090398e44a742e0_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
1f3513dfc2078c75f090398e44a742e0
-
SHA1
fcc57ae8b769a46c5888a5c359708a1b63f0f747
-
SHA256
cbe1872011022c61f43e49cd6968a42dd3334cf91f90607c01b4686957e059a1
-
SHA512
29918425dc7d5529ec2cba85d38e2e84c9d6001db4776eb19f6d103011b425f5b694c6ec3c5c0d304da5bf8e885d16115fdbc27d201a98585fb0c25597ce687e
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBx9w4Sx:+R0pI/IQlUoMPdmpSpl4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f3513dfc2078c75f090398e44a742e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f3513dfc2078c75f090398e44a742e0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrvAY\xoptisys.exeC:\SysDrvAY\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD569b481f9f90847d73551813dfca02243
SHA17e5edc293d3c4e5d3c2104cea34089c9147e12b6
SHA256e4e94e50c8c4278c186e69316843d8b420652da46f4c2603dca35afece1719d1
SHA5125d819612b9ec9ef51131e8e222a35b368f9b2250feb8a5447ea15f9428fb596cde9a06349d31a170637166059d3a1960a6a767c603c53faa799445b939866044
-
Filesize
2.7MB
MD53ca414af968363fbcd8126aea0f2ec6b
SHA116129c551a976e7519a1d1a81587275fabb76968
SHA2564cbae6c6066a977b3de0752fc6ab730f8ea084d8e8849d6f604b510d2ba7c751
SHA5120897883dd96ccf65fcf2f5d9d9128b7a0cbed909f4699a1fc9370c3f641f6230ad2efb2480f26cab629b002334933d49e266829aea3ff23ac7143c3bfeeede5f
-
Filesize
203B
MD51cfc8412b926cec219735f67bb067fe1
SHA1848ed0928641c414bf31af7b74663e7c196aaefa
SHA25681ca44cd62c57111991cb2c240a378473ddc49cd726e1ba91bac8b19dec15fae
SHA512abbc210fd4656a4344f776d866f59b2e92167b2c54e8c3238a161c4244a5b8eaeb3b76850ebc9b3a00d1b42febd0eda6e5982b249c5b92c6bc502f2dab106d1a