Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 23:38
General
-
Target
59a06761c0708e67d2cc04b03f85f2a0_NeikiAnalytics.exe
-
Size
64KB
-
MD5
59a06761c0708e67d2cc04b03f85f2a0
-
SHA1
0b3629f9ec11a96b2368ea0720a6266b383f2f09
-
SHA256
e210714cf9ad0c8ce1abf38c9a941d0a87a9c79233966b23caf364c0d424b734
-
SHA512
738281fbddcee37fae3cc168a02780cbf4bf5f80713a686361b822f0125126b92751648ba6e9e8c9f108916b596c7ad29347e9996a6826d618a342205a83474f
-
SSDEEP
192:ObOzawOs81elJHsc45HcRZOgtSWcWaOT2QLrCqwgY04/CFxyNhoy5tm:ObLwOs8AHsc4pMfwIKQLrou4/CFsrdm
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59a06761c0708e67d2cc04b03f85f2a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\59a06761c0708e67d2cc04b03f85f2a0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFBEF468-306D-40fc-ADC9-1418055EA002}.exeC:\Windows\{BFBEF468-306D-40fc-ADC9-1418055EA002}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30B14D93-67E6-480a-B68E-6DD177729EB3}.exeC:\Windows\{30B14D93-67E6-480a-B68E-6DD177729EB3}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E06BE0D6-1CD7-4692-95E7-464F38FC80FC}.exeC:\Windows\{E06BE0D6-1CD7-4692-95E7-464F38FC80FC}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F32CF680-2E6A-4147-8925-237F9751790F}.exeC:\Windows\{F32CF680-2E6A-4147-8925-237F9751790F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD5A5A0A-4A74-4d1c-BEB3-46EDF96B2B7A}.exeC:\Windows\{AD5A5A0A-4A74-4d1c-BEB3-46EDF96B2B7A}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C97C981B-4814-40ed-A2C6-B4DCAC871028}.exeC:\Windows\{C97C981B-4814-40ed-A2C6-B4DCAC871028}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA988CE9-6EF7-4cfd-AFC4-81B14366A6B7}.exeC:\Windows\{FA988CE9-6EF7-4cfd-AFC4-81B14366A6B7}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87C840BE-CF3C-402c-8657-7A85273A7433}.exeC:\Windows\{87C840BE-CF3C-402c-8657-7A85273A7433}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D8A6E13A-069C-4b63-BD8A-17D55673CE0B}.exeC:\Windows\{D8A6E13A-069C-4b63-BD8A-17D55673CE0B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3697E7E7-42AA-494d-810E-9AB5C732B89E}.exeC:\Windows\{3697E7E7-42AA-494d-810E-9AB5C732B89E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{16EC78F2-3866-4a70-A294-8909AA87B218}.exeC:\Windows\{16EC78F2-3866-4a70-A294-8909AA87B218}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3697E~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8A6E~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87C84~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA988~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C97C9~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD5A5~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F32CF~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E06BE~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30B14~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFBEF~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\59A067~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52234f5e50ac5d278cb6c0ed73ad8c28c
SHA103872ea5e47bdba91a364e04c492b67e36f081b2
SHA2568736b229a687e8eb2b96c9c230b5170d329d8c5236f6f14844f9091c7d448b7e
SHA512c897d45f06557a4b6685bfb48f64a894c827dcf54cec43bb316a01577d9eba9268f3d7731ef39e3a4356c1c4b0b4e54443ae62fb6c94d8f1831889403f0e7685
-
Filesize
64KB
MD57662dc433a5ee227401e4c4859fd1a05
SHA182b4d65aa9e5b832146e06acb0276c7322831c44
SHA256bc8af6e4b6dc6300c233af125c519443b3dcfdcc7574b56d0fb6e80ff4bc0854
SHA5124acb54ce4e45be6e35a0c46de3ba7b61764db31c80be0a482671912915a5ab1d39402cbb41c5a054a7d5f9a687792387fa7983e6541207a9c769dccbcb2eaf6f
-
Filesize
64KB
MD5173fecbd9c3f63cf29dd3413c9e5f3f5
SHA12707a4ea2ca22f0b2cf0360c41d37a2819bc10f7
SHA256ef154ffa510a5d732291df8dd704d7f3947392c67a2f1319251bc4003234cddf
SHA512bbc4af5b9f83325501edd5339ea0b146778f743d21fb98768d57bf4fd8fe8e6682858b11b04f3a8afdff362c52ab00be6e2119e8ea433ccf032af9fef96e6b42
-
Filesize
64KB
MD56bd1aa5367ee7a39acf55f0ec8bff324
SHA10f563296eca033116b44f0e89fe7678230983a1f
SHA25643e2cafe0130f7723eeb1a49c2131c31afe0f8d3cb73d2d0f676965aa8ef07a7
SHA512c07f9c45273751dbf8400e0b712a77ed3bace26e717e407a3a996983c06141fe0cd76b1d898240eb93b7a9e036a4e6b3cb94a99146c416295566b7623e1a6f5e
-
Filesize
64KB
MD58440c39671cf79a832d13f5d00112927
SHA194b2d1deef3fdc554ed7ddd7baae9409ee4805df
SHA25655ca5a11835c5b9c8897c29174bb0c3df3150eae43895b4a5f8bdfdfbd8a99ee
SHA5128705f05b5abe0d0dd5cc5d99e5dce328940b2dda3697b3bac6b152a5a4ab83fdbbb9bdf86885a3be7cc17e285f019ac13e1d3ab55cd70b8b8f53ea2a54cfc27b
-
Filesize
64KB
MD5d3f9738ae7c9aba60058e71ac3138654
SHA162c9160620228e7ae71a38fe01f6e2273abecd91
SHA2564eff1e6a1a2de3669a3b4f4af8182eb11f8fb3b3153ac6f6fb8e00bdbf998575
SHA512d1fc7ffc794027e32335ec907d8aa16d0797551c840049172c271e82cafcf1b73beb7f274cdf8f4b47edc2612be7b67d76e5ead235a77aa46975e2e11e6c2f70
-
Filesize
64KB
MD5de3d0a8a70c24a86eeec5b7451188878
SHA1cc587e852b92f8d61b2b3018b2d00e9e46ccd864
SHA256c1c9d8503b684545aba77ac6e616f661da946c4629bff7954e522ecb9cfbda30
SHA512c5e51bad4f8cee2f25d987787f12f606e6b324ce05d293746d91b05df863e82b79af8408e52e38c59c47625ee782d1157e459db82b9bef4d1093ce17ff8cabd9
-
Filesize
64KB
MD58bb840243ab3c6ae60a5162a8a37fa26
SHA155c3360997c60a09d9dc5b6a58574330910d5022
SHA2566249a62ff06826aecbe0eeadb8c23b62607a7702db5d39c0b1e9faa3b178b2f7
SHA5125a51f777513405ead6de21aa046212e4546cd203fdd66b4260308e9e8acb7d682916a162925daff2b02e469c43fcc9c50da1f64f241a29c412bec87b67aaa14c
-
Filesize
64KB
MD57cefd3dba17a5561aaf75814a20b8607
SHA111e290c9450880c3924c5ea9683b0e22f233a514
SHA256bbc9bb444540bf164179438ad022c3dcf84edfe2dcc405d7b013b249017b90c7
SHA51252091880e37395f600bf0eb233cd9cb8d3dfb213e2f661610cfd06dda948d2e45ea5b3c415c2c79dd10fed79cc57c47c75ac173d45df8fecf5cf0a2dfab20bb8
-
Filesize
64KB
MD5546e6714082356e16389d421f15840c5
SHA109778651e74b53279ebd35033e7e9900e72b2370
SHA25686a611dc479c494b2ff807ce2d807fe645b356f3f0fc13d7aef19e9b4bac2a8c
SHA512ea23851640490c73e135bff3852108f29cf678a5ee0ba157f223bf4f00b22b5985234a328a0ecdbbb5b75b4c7fbc0564a680ee5b07783c260a2bb2db4df94cad
-
Filesize
64KB
MD5e93389a9a6c6860a64123b51c33d216c
SHA1a072192237e355a74577a0233943b18a18d4fe3b
SHA256b9364b19f213b4d275c6af41841ce764040f41d9964a8005b07b4ab6a7cbe306
SHA512d7c812a1303ba02aa2366c76f427f25f433f01967942c7bdef69f5806a99a55916818ce936af1fd7c144d226026c4fc2e557d8d62c6489e1f4ccd908fa03aa9d
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB