d18b2cdeeabcd9b23fe3c3bbbaa60c5e0a64bb9f7f53c3ead460b243f34b3bf9

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe
Size

83KB
MD5

5aee453bb23b49ae740e2700e53528cc
SHA1

266d5b82830f569199dadef9980d2c17d7a0e7cd
SHA256

d18b2cdeeabcd9b23fe3c3bbbaa60c5e0a64bb9f7f53c3ead460b243f34b3bf9
SHA512

2002fbc29d5cdbb6054c02104a98b52c5fdf943edccd5d31f2fd5191f5aac992187810aa852596611646b830b640088ebc46c6ca93e4c837166984b02ae8ebe7
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCK:TCjsIOtEvwDpj5HE/OUHnSMr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2144	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2956	202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2144	2956	202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe	28
PID 2956 wrote to memory of 2144	2956	202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe	28
PID 2956 wrote to memory of 2144	2956	202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe	28
PID 2956 wrote to memory of 2144	2956	202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\202405205aee453bb23b49ae740e2700e53528cccryptolocker_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
43900e45905f67ab52c015dab408c053

SHA1
c58438a4c393ee1145ee313ad23bc25d86cc57a2

SHA256
2e6a46819600128409136ac3514b9c9e9865843229b05af8cdd2dcf88dd4c15d

SHA512
8d8e71d5ce45093241dfdd46188fccc87d1c6ea435bcce08b362af71be3fc07fa673b6bea425a2584263f161cfcefd33d0c0717490162c4ef9526eec222815a9

Download Submit
memory/2144-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2144-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2144-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2144-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2956-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2956-1-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2956-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2956-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2956-14-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download