36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54

Analysis

max time kernel
149s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe
Size

34KB
MD5

dd1c6e7fe1f77ded2bf3a357f3743e40
SHA1

32d8a996a286385a0c89940d2360f5b4d505b005
SHA256

36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54
SHA512

bc0229dbcf8160a66f8be962e247a23a9fdc759b5b7b4105960e1509ca6c1ed3303b2a55e0d24be119ef9359573b26a87a6fc0e61ec3569eccb3e8df6250d952
SSDEEP

768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYg

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2752	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2752	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2752	2324	36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe	28
PID 2324 wrote to memory of 2752	2324	36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe	28
PID 2324 wrote to memory of 2752	2324	36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe	28
PID 2324 wrote to memory of 2752	2324	36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36d30a3aa8d71df15d98ed81c10bbb92783fbbad2472f3d9a5ecf0eab7652e54_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
34KB

MD5
71b10734abea95103930afa89e3f12bd

SHA1
c61356d0c4494d3f48681034bc678933467da6b6

SHA256
e465087b6c565e33957cb5dfa7b05723ba43cc10c45bc27105fb09306c07b30c

SHA512
c3098cb6d2868b54fc8c976dbf6fb07bae14ebf3f7dcd4877d3b19a22ede6ef56dc676f4ee4c53c0406a95e91e3fd1af3daef10fb3dad9e3f5153ae3a24bf05a

Download Submit
memory/2324-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2324-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2752-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads