4d846b95328836c6bd40cd2df1b32a5d7214aeca8383962e39075d423cdf7412

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe
Size

39KB
MD5

9162b3ce3ef5cde6938eb160b7b995d0
SHA1

d4c8e13849e4e67ecd738c37bdf768b40ea011c9
SHA256

4d846b95328836c6bd40cd2df1b32a5d7214aeca8383962e39075d423cdf7412
SHA512

3907d53fce6165d86f6be32ec0108121110fa82381db270984bdff75fa750822b2fe6d753d93f72eb7439cf17054f49cdc056a112495d04aa6f6b8d7007ee10f
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunRSyHmYvV8ZV:btB9g/WItCSsAGjX7e9N0hunRvGIV8ZV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3024	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1688	9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe
3024	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3024	1688	9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe	28
PID 1688 wrote to memory of 3024	1688	9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe	28
PID 1688 wrote to memory of 3024	1688	9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe	28
PID 1688 wrote to memory of 3024	1688	9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9162b3ce3ef5cde6938eb160b7b995d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
39KB

MD5
9c70876356dc13b7d2b6297f93d8efd7

SHA1
827683d8b024b18c1b5be60d4c15f1ca659dd2b3

SHA256
e74a1e616d12e4fd935c69d54019adb24d52ff0d25ad9bb3cd50cd1be37b5975

SHA512
4607a321a84236e5bec118d519e3eb84074c20e8c8ff8e97342bc46b3fe1d298119ad50f6217d15081f2a50779fbcdee23d09b467789bae6e36e1a4cc492aa34

Download Submit
memory/1688-0-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1688-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1688-8-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/3024-23-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download