ea93261d888ab83a1951a282882ebdb099b762e9187c459344b121df96ee4b31

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:19

Target

55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe
Size

53KB
MD5

55bcff2d9a05d960af5b59cbd8701110
SHA1

f0a558f1fe4065fc5cb77cdf9cbc483969d9c6ed
SHA256

ea93261d888ab83a1951a282882ebdb099b762e9187c459344b121df96ee4b31
SHA512

c73513a588a6f90a193b6f8598bb88d38ebace8663b71a74b52a5382e5f7d4777d9383aa2ec825914a8b78ec174267b7e0b4336e406f554ceb7b3c344c32b2e4
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHp:6j+1NMOtEvwDpjr8hhXiJ

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2348 misid.exe
Loads dropped DLL 1 IoCs

Processes:

55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe

pid process

2244 55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2348	misid.exe

pid	process
2244	55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe

description	pid	process	target process
PID 2244 wrote to memory of 2348	2244	55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe	misid.exe
PID 2244 wrote to memory of 2348	2244	55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe	misid.exe
PID 2244 wrote to memory of 2348	2244	55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe	misid.exe
PID 2244 wrote to memory of 2348	2244	55bcff2d9a05d960af5b59cbd8701110_NeikiAnalytics.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2348

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
d1eda24999733d46f6ac4274b69e09c1

SHA1
b69e2d078f2e32d515fb42bb3f990f4f863bf51c

SHA256
e2e470f58e1a8fa08f5a15342dcec9db72c0714029d042c677d3c04d07bcbcc4

SHA512
a6630b22f2e59d9b4cda749c23d33a578abc6898e362eb45d853164b3a61db58393a1b6ac9874ce309306a6f883f9f1ddf3475e7b41eead2b260943cfd7cbda9

Download Submit
memory/2244-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2244-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2244-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2244-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2244-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2348-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2348-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2348-18-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2348-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download