Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-05-2024 07:00
General
-
Target
cb6b1c318381e0d84d5aca084beced80_NeikiAnalytics.exe
-
Size
959KB
-
MD5
cb6b1c318381e0d84d5aca084beced80
-
SHA1
58c703af36b3f0ff5766b82752b7c6ff110f80dd
-
SHA256
d24f9bc2a12b081e231eee4807c110ee33e0bd3ef88bb2fe5930da237e65ea8f
-
SHA512
f4844cf45be991601fee7f458f3b072883cf683e58749e13b6e28f5c3a08c1e48669459384823775e3ae1f605d52412fc1f062103880ff29d0e86196335decc6
-
SSDEEP
12288:7n7P4lVdgPJ38SmYcdBK0wVrghjdOdOx/XSgVz27Mfmq2KQ39:7n7wlV6PW1YABK0HZ27Mn
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
windows/reverse_tcp
C2
0.0.17.92:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\cb6b1c318381e0d84d5aca084beced80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cb6b1c318381e0d84d5aca084beced80_NeikiAnalytics.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-18-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/3668-0-0x00000293B6600000-0x00000293B6601000-memory.dmpFilesize
4KB
-
memory/3668-19-0x00007FF7D6F60000-0x00007FF7D7057000-memory.dmpFilesize
988KB