28f013332195b5e8fc2d9a823a951d09dfe2bae4e67c11b44f9cabf16d817a83

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe
Size

408KB
MD5

15ffb51a6c236f77918597bb424b4d10
SHA1

b5b5cf507b56a1544f90e9b1cdaa0a55c8bca735
SHA256

28f013332195b5e8fc2d9a823a951d09dfe2bae4e67c11b44f9cabf16d817a83
SHA512

7f90d7ed2a946ee63dca3e0b84a1a41b025c191d8c21d1d0d009658bc124074ced162c3480a80d1d90558d33cae9e9011f90ec7e95d304736d3c49b68cd855d5
SSDEEP

12288:4jauDReWdj0UOak2RApGsaeGvs0ZL+dOyaeYfB:4DDR0UOak2RIjGv3ZL+dOyaxfB

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

nlaioq.exe

pid process

2352 nlaioq.exe
Loads dropped DLL 2 IoCs

Processes:

15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe

pid process

2864 15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe
2864 15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe

pid	process
2352	nlaioq.exe

pid	process
2864	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe
2864	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nlaioq.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\nlaioq.exe"	nlaioq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe

description	pid	process	target process
PID 2864 wrote to memory of 2352	2864	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe	nlaioq.exe
PID 2864 wrote to memory of 2352	2864	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe	nlaioq.exe
PID 2864 wrote to memory of 2352	2864	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe	nlaioq.exe
PID 2864 wrote to memory of 2352	2864	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe	nlaioq.exe

C:\Users\Admin\AppData\Local\Temp\15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864

C:\ProgramData\nlaioq.exe
"C:\ProgramData\nlaioq.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2352

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe
Filesize
408KB

MD5
503cdf5790d115d24b380721a390cb7a

SHA1
9ba511e29d839578529b389a4836efc16a0406a4

SHA256
5fc67f21463e984e3ac76dabb13e29ff862451d85975b6924a0373382e39167f

SHA512
ad36b1678501735c46a512ab53b6439a0d5904ee770395ddc3abdca31a4d39268bee5a1bf80832f1a645b1434973a2e83ba9e2faaf49eccf3b55df1379f23cb4

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
\ProgramData\nlaioq.exe
Filesize
271KB

MD5
09473b3e3b4f7bd300a07e0eb9d81d0e

SHA1
cdb2aebf2643429c186a646c1f82fe19b2a8874e

SHA256
bdac1bbe042220b1a70c73dbc3d7cf6d3aec2c773725229a71137679c2177cb5

SHA512
595e8e4a1c7c11a41291113de789c3cdafb5d538fa555bbb7a29ac98bd4a59f85d1b0af689c6ddb402361566bf92e98d11a2d36aed57044cc7333cab4d03a98e

Download Submit
memory/2352-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2864-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2864-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2864-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads