Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
20/05/2024, 05:55
General
-
Target
bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
-
Size
45KB
-
MD5
bebd7c90d3c6e7441357fa81d19bae90
-
SHA1
99d01f9f085610f3b7e964d679a61379e28d7367
-
SHA256
80b226f3c2a5571daf8301661277a25899fc6622b8ff4e0b1ddea99821ae6907
-
SHA512
f545b5d8e4181891647dd9a44a207632e1369772ea24786d9360c4b744475387b79805b59fd166a7be13db453837401e18b7bb7306dbadf08749864570e1d112
-
SSDEEP
768:zIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77NPQ1TTGfGYy6KL:zI0OGrOy6NvSpMZVQ1JQKL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD51fc3c72a292ed8047d163ebb22c90969
SHA10a78d555786c63dba5fdc9af5570bab18ec9c58e
SHA2560a8782b2e4f300d0eb4722ad18684bb4632379634c13e20575e0fa64d6cfa985
SHA512222391ef29ec1f1708b8709e082ef0e2ea991632180478bbfcd71e3e4bb3abbadfde3ecb5ba9594e7b1dd5557c5b771f298a3922113921770958253837dca1c5
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB