592096f1919727b1be5cb0e11302cdf4ef1ea1170dccd64893581afc07cf23a7

Analysis

max time kernel
149s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:20

Target

1451808e039127828dc813b74ac28430_NeikiAnalytics.exe
Size

3KB
MD5

1451808e039127828dc813b74ac28430
SHA1

282a215c72b532e6016490cc862b4a89bf0f3a26
SHA256

592096f1919727b1be5cb0e11302cdf4ef1ea1170dccd64893581afc07cf23a7
SHA512

29dd6473c7de6428898eb3c54819c8aaef2582643cecbb40999aff5b8efa68b9569a0f113a4815b38f05c3d839b407672e9a21c60a9c560f0de87a2fc328757d

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

yxazj.exe

pid process

1064 yxazj.exe
Loads dropped DLL 2 IoCs

Processes:

1451808e039127828dc813b74ac28430_NeikiAnalytics.exe

pid process

1972 1451808e039127828dc813b74ac28430_NeikiAnalytics.exe
1972 1451808e039127828dc813b74ac28430_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1064	yxazj.exe

pid	process
1972	1451808e039127828dc813b74ac28430_NeikiAnalytics.exe
1972	1451808e039127828dc813b74ac28430_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1451808e039127828dc813b74ac28430_NeikiAnalytics.exe

description	pid	process	target process
PID 1972 wrote to memory of 1064	1972	1451808e039127828dc813b74ac28430_NeikiAnalytics.exe	yxazj.exe
PID 1972 wrote to memory of 1064	1972	1451808e039127828dc813b74ac28430_NeikiAnalytics.exe	yxazj.exe
PID 1972 wrote to memory of 1064	1972	1451808e039127828dc813b74ac28430_NeikiAnalytics.exe	yxazj.exe
PID 1972 wrote to memory of 1064	1972	1451808e039127828dc813b74ac28430_NeikiAnalytics.exe	yxazj.exe

C:\Users\Admin\AppData\Local\Temp\yxazj.exe
"C:\Users\Admin\AppData\Local\Temp\yxazj.exe"
2⤵
- Executes dropped EXE
PID:1064

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\yxazj.exe

Filesize
3KB

MD5
4cbadf6eebb948a2ca7466985c0a8753

SHA1
740318d64453dd43d3511c2f1429f2176c321a00

SHA256
e351f8156d20768362b099ee27880dd9aa3552f8c9e9cb3890a3093af6fb6e6b

SHA512
5ba55dcfb1f3ee565f837beabe8b9c401cc732049182a529ac9dd5e85f0bd3d2edcd4bb3dc468d5bd7bb62f1ac0b6ea0f28267efe931d56dff5c5112761296db

Download Submit