3c6a64d57f47d295dc66c724b2738ab0a3817e95562c28a1cc1cbef6d97829bc

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:34

Target

413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe
Size

60KB
MD5

413b26605e45effce64aa919d524fa40
SHA1

a83bf8a9ce96149378efc2cfd9be945823233045
SHA256

3c6a64d57f47d295dc66c724b2738ab0a3817e95562c28a1cc1cbef6d97829bc
SHA512

9d54ede0625076f88b17b5b5fbf33dc55bf019bba20009714a0c9f510c64ec18b7cf57d9e93431fbb9bebdbe90099f5afbf4c362edb3cfd64eaf785a586d93b2
SSDEEP

768:szM/e9xPnxrdAakEfzQsEkejRLXmIdgssROTrj2q:3/Q5xmGXEkejRLXmIdYRG

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

pwhxl.exe

pid process

3004 pwhxl.exe
Loads dropped DLL 2 IoCs

Processes:

413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe

pid process

2172 413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe
2172 413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3004	pwhxl.exe

pid	process
2172	413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe
2172	413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe

description	pid	process	target process
PID 2172 wrote to memory of 3004	2172	413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe	pwhxl.exe
PID 2172 wrote to memory of 3004	2172	413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe	pwhxl.exe
PID 2172 wrote to memory of 3004	2172	413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe	pwhxl.exe
PID 2172 wrote to memory of 3004	2172	413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe	pwhxl.exe

C:\Users\Admin\AppData\Local\Temp\413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\413b26605e45effce64aa919d524fa40_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\pwhxl.exe
  "C:\Users\Admin\AppData\Local\Temp\pwhxl.exe"
  2⤵
  - Executes dropped EXE
  PID:3004

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\pwhxl.exe

Filesize
60KB

MD5
4b64e5ef908e049329e25a31e0879af2

SHA1
f709515ddda27cfa3039f9eacb22f5f692de99ef

SHA256
6834b70276c005ad0076131aa8a3fb41c7b6926898a2de3df12862821ef6f10f

SHA512
b5804c1311fcc670ef040486a64b485683e4a8d78f971497bcde80ee4b42f55a4a2951d1b76bebd247ee8b78083d3dc07e98ca924663667f6f7ff3f746b90119

Download Submit