a26a967faa834ad96ebef5d5315747a964cd1f856731c051cbaad7e79f2ab958

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe
Size

78KB
MD5

4b764a3e728d2254dd59b0131683eb40
SHA1

9db089b8dacdde0ea1a41edf7f54aaf64b2c05c7
SHA256

a26a967faa834ad96ebef5d5315747a964cd1f856731c051cbaad7e79f2ab958
SHA512

66d98ef8949db0744d2c8c4c8f8e29777cf90fcfac351ee7b252d60d2a565475b925d5cde653d1f249ffe2280f0b04e32cba9f61a0546f2292f66a65856b4627
SSDEEP

768:EilivXrVKpVhKvtxwYHwVFoeAQgmucwUvfVAThsf4vvvWTDoNMe:XlqrVKprVuQg4fVAhNz

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

2276 jusched.exe
Loads dropped DLL 2 IoCs

Processes:

4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe

pid process

2980 4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe
2980 4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe

pid	process
2980	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe
2980	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe

Drops file in Program Files directory 2 IoCs

Processes:

4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files (x86)\589df5e7\589df5e7	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe
File created	C:\Program Files (x86)\589df5e7\jusched.exe	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jusched.exe

pid	process
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe
2276	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe

description	pid	process	target process
PID 2980 wrote to memory of 2276	2980	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe	jusched.exe
PID 2980 wrote to memory of 2276	2980	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe	jusched.exe
PID 2980 wrote to memory of 2276	2980	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe	jusched.exe
PID 2980 wrote to memory of 2276	2980	4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b764a3e728d2254dd59b0131683eb40_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\589df5e7\jusched.exe
  "C:\Program Files (x86)\589df5e7\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\589df5e7\589df5e7

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
\Program Files (x86)\589df5e7\jusched.exe

Filesize
78KB

MD5
060f9888108df1d7728bcd9881090184

SHA1
67242e88df40446eb49e01678408edb9bb4af985

SHA256
ffdcb487cc5f9f601878cdd47040eac778a090c0e1d4a242fd8bcff9a627b0bd

SHA512
77510f5ff31a55facd71e0d932512a26996850d8075c3105d9a5e29ad78abca449ee25fc44deab88c173b82c212121313b84096c9579f4670d18a8f342bb5354

Download Submit
memory/2276-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2980-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2980-6-0x0000000002A00000-0x0000000002A21000-memory.dmp

Filesize
132KB

Download
memory/2980-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download