28f013332195b5e8fc2d9a823a951d09dfe2bae4e67c11b44f9cabf16d817a83

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe
Size

408KB
MD5

15ffb51a6c236f77918597bb424b4d10
SHA1

b5b5cf507b56a1544f90e9b1cdaa0a55c8bca735
SHA256

28f013332195b5e8fc2d9a823a951d09dfe2bae4e67c11b44f9cabf16d817a83
SHA512

7f90d7ed2a946ee63dca3e0b84a1a41b025c191d8c21d1d0d009658bc124074ced162c3480a80d1d90558d33cae9e9011f90ec7e95d304736d3c49b68cd855d5
SSDEEP

12288:4jauDReWdj0UOak2RApGsaeGvs0ZL+dOyaeYfB:4DDR0UOak2RIjGv3ZL+dOyaxfB

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ngafd.exe

pid process

4660 ngafd.exe

pid	process
4660	ngafd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ngafd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\ngafd.exe"	ngafd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe

description	pid	process	target process
PID 4732 wrote to memory of 4660	4732	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe	ngafd.exe
PID 4732 wrote to memory of 4660	4732	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe	ngafd.exe
PID 4732 wrote to memory of 4660	4732	15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe	ngafd.exe

C:\Users\Admin\AppData\Local\Temp\15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15ffb51a6c236f77918597bb424b4d10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732

C:\ProgramData\ngafd.exe
"C:\ProgramData\ngafd.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DDF.sys .exe
Filesize
408KB

MD5
139e2aa556d4df4205d729dffeb052e0

SHA1
f336efe5fdd1d00ef1d4cd08da6e58bee5888670

SHA256
5ceb2a99c4c52f32be89c06317d47b3aa65711fcc645521055af704e7a88237c

SHA512
2e32d6e26dee4d73fda17295cea996eb7a4d88c24ec0eb364082bc97d096472523afe63e56731b6e762551e3a0241f4cecbafdb3bd6674b99affb9e6cba33297

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\ngafd.exe
Filesize
271KB

MD5
09473b3e3b4f7bd300a07e0eb9d81d0e

SHA1
cdb2aebf2643429c186a646c1f82fe19b2a8874e

SHA256
bdac1bbe042220b1a70c73dbc3d7cf6d3aec2c773725229a71137679c2177cb5

SHA512
595e8e4a1c7c11a41291113de789c3cdafb5d538fa555bbb7a29ac98bd4a59f85d1b0af689c6ddb402361566bf92e98d11a2d36aed57044cc7333cab4d03a98e

Download Submit
memory/4660-132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4732-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4732-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4732-9-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download