7b820bf4b0351cc05d879cd89f81d4004da66787c895b3f0c9283fd3b44d105f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exe
Size

407KB
MD5

5357afbe6558615371e692eae1bb2f70
SHA1

beb92cc96cad9b1a66ae2d55d3692e59f78bad38
SHA256

7b820bf4b0351cc05d879cd89f81d4004da66787c895b3f0c9283fd3b44d105f
SHA512

aeae9ef57fbfc2c7325a8d7f6ba9f3a65f4f80047838d49ce41c98efcdc0b261da48051fba5c4bfa8568f77887444de099f0f111d160793a9dfdd4c3d15b986b
SSDEEP

6144:/ZT2k0YujF59B+SNiT1SRws339pnPJ7ImcZWTbe:dFxujX9B+lAb9Im+WTK

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112
Executes dropped EXE 1 IoCs

Processes:

zketugg.exe

pid process

3044 zketugg.exe

pid	process
3044	zketugg.exe

Drops file in Program Files directory 2 IoCs

Processes:

5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exezketugg.exe

description	ioc	process
File created	C:\PROGRA~3\Mozilla\zketugg.exe	5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exe
File created	C:\PROGRA~3\Mozilla\hbibisc.dll	zketugg.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exezketugg.exe

pid process

308 5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exe
3044 zketugg.exe

pid	process
308	5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exe
3044	zketugg.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1380 wrote to memory of 3044	1380	taskeng.exe	zketugg.exe
PID 1380 wrote to memory of 3044	1380	taskeng.exe	zketugg.exe
PID 1380 wrote to memory of 3044	1380	taskeng.exe	zketugg.exe
PID 1380 wrote to memory of 3044	1380	taskeng.exe	zketugg.exe

C:\Users\Admin\AppData\Local\Temp\5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5357afbe6558615371e692eae1bb2f70_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:308

C:\Windows\system32\taskeng.exe
taskeng.exe {54C3DDC2-8B2A-4300-850E-6B8DF89EB6C8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\PROGRA~3\Mozilla\zketugg.exe
C:\PROGRA~3\Mozilla\zketugg.exe -bsvwzxb
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:3044

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\zketugg.exe
Filesize
407KB

MD5
f50ecb623992b60e68847a264e82068d

SHA1
d2dbacee10ee1b616b1291c0a0a971eba5345e8b

SHA256
6014d5d0e82f13bbe2bcbf62fa1cb87368657ead1f553038dceb869c44d933bc

SHA512
0df99e55aa8f91a91206159004d1443617a781783b370f6f4eccfe1fa2f6a00aaa2f454e725623b980d339451c3418012f2be6aa91176c14400b2dc18fbf68c5

Download Submit
memory/308-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/308-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/308-1-0x0000000000270000-0x00000000002CB000-memory.dmp

Filesize
364KB

Download
memory/308-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3044-7-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3044-8-0x0000000000470000-0x00000000004CB000-memory.dmp

Filesize
364KB

Download
memory/3044-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3044-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download