Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
19/05/2024, 21:22
General
-
Target
3d0a6776666a1592b5507af8aa8d4650_NeikiAnalytics.exe
-
Size
135KB
-
MD5
3d0a6776666a1592b5507af8aa8d4650
-
SHA1
afabb2f6d222caaa6a243d4865c49fdf5d888957
-
SHA256
9ba8ab14309293608264f5bfb08411bc3400e52db5cc0fbbd1f7597ba51be5a7
-
SHA512
bfa8ffc3622a1bdca1de00f09ebc510be0e4af8a19bfc2552e5e20a552197c7625de7b69966ec2b05e87764e3122ee671d254eea58c5b605682d261d4c62b45f
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV5dQ:UVqoCl/YgjxEufVU0TbTyDDal7dQ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d0a6776666a1592b5507af8aa8d4650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3d0a6776666a1592b5507af8aa8d4650_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD55ef6cfe57b70de8a86f19b5c6328652a
SHA1993ab0d04dec871c890e63b40e9c5eaba0d6a584
SHA256ddc075e64f9cc5cdb4c55be4d0d440ccb1c0023be174fe8c48f699eea8c7d26d
SHA5121d99c6c7041d578a21435a787f21e00c68c932168996fb7addfa728effe8e471856c978f4cf2f55be330a81f0766d2dc7fb31749dc0abf7a6f9a5fbb922e034e
-
Filesize
135KB
MD5add4d8a09f837920cb8030bb486272bd
SHA19996c90a797aab9fdfd85fa36d2a3a142abe7896
SHA256424d6d009d5feb73aa20df50c5e403d33a22c9b7cc10db4854222fe8ec122af2
SHA51277bb414ba95f4267befe1cec368cb9d11284c79294cbcf13a59458b8a23b050ed44e6bdae7ceecdd6daa461c6e437f6f2a75bebee6850c4727060b1ae51b0b04
-
Filesize
135KB
MD5abc32deed4ea4a9e7166098a6f31d80f
SHA108d951c997bbe2f1ec5ccf833fbe849605097cd2
SHA25610e4e557dd2aaa17445c720dae587518ae702da2f562997690d27a7dea0ef4ae
SHA5122fe063c8b7970160e11a621d4def5363203d2f076beb8f97deca5a7dc920e177274417555a42c506c2f4ad89ba3a2fa5561c72c4c311f2c5dc5a4f5d41548446
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB