Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 23:25
General
-
Target
574b38d4eb0f3bd985d09a1ef3b55a10_NeikiAnalytics.exe
-
Size
90KB
-
MD5
574b38d4eb0f3bd985d09a1ef3b55a10
-
SHA1
59d56f471e123d70dc077194ef21255612253f1e
-
SHA256
4d40c41be9c90a6773b907665be489a04be5c6667ee93758816764fa99527844
-
SHA512
d60bca7aa563f2e7a4da27bc801992c3ca7fccd66e777ee52d7d9671e939d879ea586c19c97d8678ba09de554163f5ec206d4b72ea6ec778b48a132311906a3d
-
SSDEEP
768:Qvw9816vhKQLro54/wQRNrfrunMxVFA3b7glw6:YEGh0o5l2unMxVS3Hgl
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\574b38d4eb0f3bd985d09a1ef3b55a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\574b38d4eb0f3bd985d09a1ef3b55a10_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE56E7A5-D940-4958-87A4-EDFC1CB891CE}.exeC:\Windows\{BE56E7A5-D940-4958-87A4-EDFC1CB891CE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{809864D1-115C-4f98-9022-B31E869BF076}.exeC:\Windows\{809864D1-115C-4f98-9022-B31E869BF076}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C0232F4-A21B-45f8-AA7C-A0493AFD3581}.exeC:\Windows\{9C0232F4-A21B-45f8-AA7C-A0493AFD3581}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC308F4A-C5AC-4340-AAC7-7A121B22C65A}.exeC:\Windows\{DC308F4A-C5AC-4340-AAC7-7A121B22C65A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CDA3C26-F336-46f3-AC3F-68287AAED36B}.exeC:\Windows\{9CDA3C26-F336-46f3-AC3F-68287AAED36B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF5251ED-0837-433c-BDE6-4433E86C8E7C}.exeC:\Windows\{FF5251ED-0837-433c-BDE6-4433E86C8E7C}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A62D08B-B461-4ecc-A90B-1CB44892320A}.exeC:\Windows\{7A62D08B-B461-4ecc-A90B-1CB44892320A}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77D31743-768A-47f6-BB6E-16878B6F3A74}.exeC:\Windows\{77D31743-768A-47f6-BB6E-16878B6F3A74}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{E64BBC9E-4734-4648-956E-3CD42F413638}.exeC:\Windows\{E64BBC9E-4734-4648-956E-3CD42F413638}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8698705D-81A0-4c27-BE56-7E8D890F8314}.exeC:\Windows\{8698705D-81A0-4c27-BE56-7E8D890F8314}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{71CEA9E3-689F-48d4-A4AF-8433E41026D1}.exeC:\Windows\{71CEA9E3-689F-48d4-A4AF-8433E41026D1}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86987~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E64BB~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77D31~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A62D~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF525~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CDA3~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC308~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C023~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80986~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE56E~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\574B38~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD558e848ca06c2a3106a37944c0bd391d1
SHA1bea14bda001a6debbd4cdc567f672703b4e1589e
SHA2567e090ba0a50ec0ad1a1eabeabba61e084d09998d326d0fb86b8d28cbad358aff
SHA512077a0ccea9fd928c406b0a65196533a5d97db0beb0c8571aae6bf383b7440a22276acb1ca04936bb78de2936b0fbd0a7e11f52dde832683ca5cbf37edf6b084e
-
Filesize
90KB
MD5f751f2f6b310b806b43e952c0355b060
SHA1599d3f1b1811c4bc738253cedfa880eee5ed2a8b
SHA2567227c066ac0bb835c357eb303288cb9f645d6bdb5852151a31c15666cd93364c
SHA51237b2c93991ce3e9de899396ade450d8849234ef5cb4225bd7194a1fee8e9deb3223be30d108dc31e9ea204d2ab14aec9068f91847b9d593cf93f9be979806c2d
-
Filesize
90KB
MD54f4d980cbf16f481fa7c482c6acb4140
SHA177d7495fae2a5dfa061a22c49f37cebfbf447b08
SHA2569a893ca73f94a84c119011ef059e000369fe7b1b55c8b944760b932d9d2d06dd
SHA5123ee414284e4f1705f1452536c66b1ad7adaf6e06c1784b3f2d4fd502a5704859b98e55d6397ed5d42f3bd9a6a352097670a8b7846aec87afa75feec823c8f554
-
Filesize
90KB
MD527c8999227cb3ac35748cc9794fc062f
SHA1b14035f83965c927b0d1f30f3c37847ab7bd8281
SHA25626ec1a9639cf0d35fa0fd6a900baf997794b831ac56dc163959cc237c5ab8ded
SHA512659736f8361e57794aa5cf26a32a230a6f9a2550d40cd599a50a24fda1223ea02d61374c335b7ebf6ffe8b29223e4dc7314b016ef53c164ab920298c1893f9ed
-
Filesize
90KB
MD5d836cbbe288aaf06a42a74b5dff391d5
SHA116cf63360886e4e3bb97df55a0a75059cdb86217
SHA2561d460a0f2b262c8692270f0995fee6bf82e7b42c2b013e91379190fe5e72c96a
SHA512b7ffd85fc972a5c53351c1b4879575ea316c7917e7c5a46a5157236f14005973b500086c1d067d14d2c05ad4da20d767bc6b7c2b8ac4c3bd9e9d11162583eefc
-
Filesize
90KB
MD5f7f1489d52de9ad07f9fd5248530d026
SHA1909a56ab6b6bbdb8932fef52bc0d270c1f21f0c3
SHA2567bbdcebbf472db7bef0bdc3012c43cfd7638a997d01add10651028df5d299799
SHA512953a0c89c5eb3dd421dc99c62d9f4e88fe6f458efd0c1cc11eca96fc365f6d98cb11eb91dd71d1abb338d72e2e2fda1ab036c5b79141b47dc4d451b5d4aeb836
-
Filesize
90KB
MD5eaaeb8878b7d7decc1b689c08f1efa9c
SHA102e822219a75b8649f45a32d14871080dc66d9f4
SHA2569976816b1c4edbd3c7e4d704e175c44ba3cf9722341374ec122f5fe1760e49ff
SHA512f7cbdba80b28f40c56b656cf84f4d493ed75bec93609f66bf065e2f41aa777f21236074216a1355222b954e352386856239df8c0c1b9ef3b065dd28518e1600e
-
Filesize
90KB
MD5017086b91a98f69c20bdd7dbd837cb28
SHA1978a1bdde571a6661c75234cbfc3b85eff3d5705
SHA256c18481422915a48aba2141db8ebcdd0f21d98512c03302b30839cd57b1c49b30
SHA512a1c9aef76066075c5f6f2b34e20a2912c3e608185aad7704a2e66bdd0c0a485557f9160e794f4f3211c065b99e353eec977ce15afeafc3bb7f98b895ffa9b294
-
Filesize
90KB
MD532dc0f6c38359c515be392c21f515270
SHA178aacca8a62a21e6b38ad52f739849316949625f
SHA256524eba208670294a46d1dda66b2d9f35f9ed33489b08afe7fd1a3f0680d362e1
SHA512d75dc580e89a90b5a2ac9333546fc63ed5c518a5a2750c17c4a04e016196c1760c3e9d964244654d0c1abedb3be294695b70047f9db56b088683b850d306a717
-
Filesize
90KB
MD5a49d9c5d111b737db3a0de598252acbf
SHA1fe2418b83112a21ea527f33862b90fc0cb7173ab
SHA256111aca7f6dafce1f325dccbb1dc2c3670baf185abaea6c1f33346e39d18a9104
SHA512a7aae36494c8651152ccd98040f1e4ec987696acd5dd8ab0c61fd5d4f5a675eded0695530f81b1379c81467acf752d917f0a56fe969bfa1a46e80442834ea4ea
-
Filesize
90KB
MD59cc7ef269fb99841f7fb82aabae3b2be
SHA1712c4ebd7f5ef175c3a21f51498293e763ca0b33
SHA256dc40e8b7a47b702c396e58082cd84417f6aacbf2a5fdfc53f15d24f703048fcf
SHA5126b785b5463b5a1afc8014c142815cc0cc30f2114d19ff7b0df5e92723d124de97b91d2b55658fe46d1a037b5342216dd09619e900f711a1cfd8bf5eec522f4c0