65469302c88ef20287d4eb086227b02962480ac58544f044f118a2226c5659e0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:34

Target

4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe
Size

54KB
MD5

4d795dabfaa3ef8373e0a20acccc7380
SHA1

720fb674da3a7256c2905a20d4e01b16c8402bf2
SHA256

65469302c88ef20287d4eb086227b02962480ac58544f044f118a2226c5659e0
SHA512

00fb7db3bd97e7533dc3cc871824259e6f1424525cab418fc91b43a4dc947e74c98af6cf6725dcc2f7fd466e1ebb72a11cb9e8bf7db3df2b67ad44f7cc8e2974
SSDEEP

768:MApQr0ovdFJI34eGxusOy9Rp1pLeAxoeC48PqK1OtaP6cCFzENREMZ7V0ge:MAaDJlMsh7pWezEPJB+OOF

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

sal.exe

pid process

2920 sal.exe
Loads dropped DLL 2 IoCs

Processes:

4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe

pid process

1624 4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe
1624 4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe
Drops file in System32 directory 1 IoCs

Processes:

4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe

description ioc process

File created \??\c:\windows\SysWOW64\sal.exe 4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2920	sal.exe

pid	process
1624	4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe
1624	4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\sal.exe	4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe

description	pid	process	target process
PID 1624 wrote to memory of 2920	1624	4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe	sal.exe
PID 1624 wrote to memory of 2920	1624	4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe	sal.exe
PID 1624 wrote to memory of 2920	1624	4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe	sal.exe
PID 1624 wrote to memory of 2920	1624	4d795dabfaa3ef8373e0a20acccc7380_NeikiAnalytics.exe	sal.exe

C:\windows\SysWOW64\sal.exe
"C:\windows\system32\sal.exe"
2⤵
- Executes dropped EXE
PID:2920

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Windows\SysWOW64\sal.exe

Filesize
54KB

MD5
3538c87c89f4afb066ebf232f590426a

SHA1
d4e4391e0742ac32230023e6dc61c6ccff59397c

SHA256
24637bfba71bee553e5532bd8c0d97a5258ad9308b4eb94e126cc0bc29073a0d

SHA512
8ed8171b3076fd24ded14815d9dbb9ca2e69c9c8955643b2387e14c577ba51ac33e514092ffc2961bc5ec07ae59db10371cab2bdd24d65b23f34780fefae3585

Download Submit
memory/1624-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1624-4-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/1624-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2920-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download