c8e66c45c7535ca7a996c8aca652e45932f85a26b23f03a36975b1ed00da6283

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe
Size

72KB
MD5

654bef64d1a649c918b18548e4de9840
SHA1

2d2befc9c3c461e95c8685227cf2d3e5d63b609d
SHA256

c8e66c45c7535ca7a996c8aca652e45932f85a26b23f03a36975b1ed00da6283
SHA512

400c1ce47cd989f77fa08200d6e23980a722059fe30f96803841ac7a5219a08c91d84def914e393fc1bf6267be1e9e22c8d3e227055975c1e259ea3799ad2255
SSDEEP

768:ZrItKyw5WHXfQmjIiIk9ecAx7pP1EPU96MyXPdtldE9bIIIwjkv:Zr3Z5IfQmv81x7pP1r3yXPdtnyjO

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2252 attrib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3068 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

rwmhost.exe

pid process

1856 rwmhost.exe

pid	process
2252	attrib.exe

pid	process
3068	cmd.exe

pid	process
1856	rwmhost.exe

Drops file in Windows directory 3 IoCs

Processes:

654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exeattrib.exe

description	ioc	process
File created	C:\Windows\Debug\rwmhost.exe	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rwmhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe

description pid process

Token: SeIncBasePriorityPrivilege 2344 654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe

description	pid	process	target process
PID 2344 wrote to memory of 2252	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	attrib.exe
PID 2344 wrote to memory of 2252	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	attrib.exe
PID 2344 wrote to memory of 2252	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	attrib.exe
PID 2344 wrote to memory of 2252	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	attrib.exe
PID 2344 wrote to memory of 3068	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	cmd.exe
PID 2344 wrote to memory of 3068	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	cmd.exe
PID 2344 wrote to memory of 3068	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	cmd.exe
PID 2344 wrote to memory of 3068	2344	654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2252 attrib.exe

pid	process
2252	attrib.exe

C:\Users\Admin\AppData\Local\Temp\654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\654bef64d1a649c918b18548e4de9840_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\rwmhost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:2252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\654BEF~1.EXE > nul
2⤵
- Deletes itself
PID:3068

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\rwmhost.exe

Filesize
72KB

MD5
36b4fead2574a2c07ea79c25b572d764

SHA1
b310686e70801eb5557bdc19f7e995a936815f9b

SHA256
72f8a586db84ec9c99ece45d74bcdb640e75c0c4f8fdefeec55c95f9345e4029

SHA512
a2d399c993110584ec9ebe0b11522a5f34aac7deabc7d81b6931cd0abe74dd6ceb008e3c04a487037b6eb69550ac0e2b419e49aa8f1b43e3045accdd806d88bb

Download Submit
memory/1856-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1856-7-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2344-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2344-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download