245b916426db931f04992c14e2934f331c406c067a76dd62b99125520ab2a670

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:30

Target

07ff6106d412fe626112d89216353930_NeikiAnalytics.exe
Size

29KB
MD5

07ff6106d412fe626112d89216353930
SHA1

b1b7f98313a3945c454c548463bdf1ee568a9cd0
SHA256

245b916426db931f04992c14e2934f331c406c067a76dd62b99125520ab2a670
SHA512

eaca8a63780cb936443ba8c4cf7254a34d98f45d1ce66ca8666d33644bb1ddfe93be8d3ac75aa9ae08226eefa4c37c4800e84ae8a15231dd54ed29c0b87d8e41
SSDEEP

768:fzQL/qXL7g5AQRBIFGEjvDgtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGWSd:fUL/o7EjR2HgtdgI2MyzNORQtOflIwoh

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

ghyte.exe

pid process

2944 ghyte.exe
Loads dropped DLL 1 IoCs

Processes:

07ff6106d412fe626112d89216353930_NeikiAnalytics.exe

pid process

1872 07ff6106d412fe626112d89216353930_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

07ff6106d412fe626112d89216353930_NeikiAnalytics.exeghyte.exe

pid process

1872 07ff6106d412fe626112d89216353930_NeikiAnalytics.exe
2944 ghyte.exe

pid	process
2944	ghyte.exe

pid	process
1872	07ff6106d412fe626112d89216353930_NeikiAnalytics.exe

pid	process
1872	07ff6106d412fe626112d89216353930_NeikiAnalytics.exe
2944	ghyte.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

07ff6106d412fe626112d89216353930_NeikiAnalytics.exe

description	pid	process	target process
PID 1872 wrote to memory of 2944	1872	07ff6106d412fe626112d89216353930_NeikiAnalytics.exe	ghyte.exe
PID 1872 wrote to memory of 2944	1872	07ff6106d412fe626112d89216353930_NeikiAnalytics.exe	ghyte.exe
PID 1872 wrote to memory of 2944	1872	07ff6106d412fe626112d89216353930_NeikiAnalytics.exe	ghyte.exe
PID 1872 wrote to memory of 2944	1872	07ff6106d412fe626112d89216353930_NeikiAnalytics.exe	ghyte.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ghyte.exe

Filesize
29KB

MD5
122b6d2a136a62ae7ca76164c7f87825

SHA1
286319fec8e9d21c234331754828504286525fc0

SHA256
ccfe62e17d5457e284263104b1d5fa68751395465c88bdd4d5bc8cdc4fdcee36

SHA512
80cd8c8fadbea6b276a7bc529124794eedaa6dbef4f1f63e1d2cf5f545b1918849b637cae45e19cd144c94eadfc70e0a3775bd144a0506bf893d01ac076ce762

Download Submit
memory/1872-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1872-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1872-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2944-23-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download