07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe
Size

42KB
MD5

fdc8c0237431dca5cfbfdd31cb5681e0
SHA1

a8bd2919b7b93d7717554f661b076f1b4a3d717c
SHA256

07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c
SHA512

06f7a9a44b523a8e7bfc53c255577f1fdd55f15be5ea4b7737774cc4faffe9d7b99deaccfc1145e934eabc96be5c6856995b41c3a0b090931382d1ed02e2f7a1
SSDEEP

384:6YwzAbTtITikpqIoxO6kAr+3EvF+3d5wOlFQSHpalsdmiY7akaH6lk+Ym+cNjBx8:yAHt0V5dFlSSJaadF0ak6+fXNNaLg5Lu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2912	fireupdater.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2912	2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe	28
PID 2528 wrote to memory of 2912	2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe	28
PID 2528 wrote to memory of 2912	2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe	28
PID 2528 wrote to memory of 2912	2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe	28
PID 2528 wrote to memory of 2912	2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe	28
PID 2528 wrote to memory of 2912	2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe	28
PID 2528 wrote to memory of 2912	2528	07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07709d6ff51550884d5e9c4200eb2b1404b92f904c5579ab83dd35cb4755947c_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\fireupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\fireupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fireupdater.exe

Filesize
42KB

MD5
c9f9baa9d941bce5cd380422a7a853f3

SHA1
c6217865e0aa1fdf2e54573156c78e47fe641e68

SHA256
dffd25a58efadea8cf1a4f5d699385437dd7eac447db0c59807db4a94936ee67

SHA512
fb4eaf82efd400fca90dadfea4d5f3330aad258216854908e6abd64d14f137fe38e492b1ce423dd7289fe5ff17ddc86684ce8b2e6d7cad1b374105aca81c3157

Download Submit
memory/2528-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2912-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download