8eae6e8647aa9abae36265ca41954079f7928dfe1a4228158f505cf570fa657f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe
Size

90KB
MD5

364edc8254d9f51dc9f3128c81a280f0
SHA1

c183a7fbe7ef46693f22157f559576fca9a52bcd
SHA256

8eae6e8647aa9abae36265ca41954079f7928dfe1a4228158f505cf570fa657f
SHA512

16636bf45e5a42b3f2650f0f134bdb9ce19eac9b8fa63790f4c2877c8c787f532d62670995bf877ccd73f498ee93e2cdd9affa67a20ee2fb3120275af16ab399
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRMy8tyblgCO:zCsanOtEvwDpjl

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2524 misid.exe
Loads dropped DLL 1 IoCs

Processes:

364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe

pid process

2220 364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe

pid	process
2524	misid.exe

pid	process
2220	364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\misid.exe	upx
behavioral1/memory/2220-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2524-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2524-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe

description	pid	process	target process
PID 2220 wrote to memory of 2524	2220	364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe	misid.exe
PID 2220 wrote to memory of 2524	2220	364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe	misid.exe
PID 2220 wrote to memory of 2524	2220	364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe	misid.exe
PID 2220 wrote to memory of 2524	2220	364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\364edc8254d9f51dc9f3128c81a280f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
90KB

MD5
e108df5575e6feb8ca80074f58c59afa

SHA1
881efdf15b369e58c41a50a22491e24aa3b18254

SHA256
45e8b9063340baf62fab07593a32724a68c15513b30f850e0868153672f09d88

SHA512
be735d11ec50106e65f3c98b5fd794c206928b886365693f6e6ffc2f2c92af4944a9ab21c77379f44184980ba433ee09c3bfe578ae4cc624b5443518938ffb2a

Download Submit
memory/2220-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2220-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2220-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2220-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2524-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2524-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2524-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download