Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23-05-2024 00:55
General
-
Target
66ad3cf29b5044dc6ac5f5475feb20f0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
66ad3cf29b5044dc6ac5f5475feb20f0
-
SHA1
a4e81dc5f7bc462e65bd76e5b1543f3f6aad621e
-
SHA256
8b75a581b815769866431bb152d11796aa8ba6d8dc22a50ab37c1cd7434c4e2f
-
SHA512
f1976026d5bd20b16a0bd04c40a3abb5bb60de266d4db35247c1cd5ae7d0acd0848a86eeb3df4348ed86a9e4baf3e31869344f60c3dbf31507f98993d11d80ed
-
SSDEEP
768:5vw981UMhKQLrop4/wQ4pNrfrunMxVFA3bA:lEG00opl3zunMxVS3c
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66ad3cf29b5044dc6ac5f5475feb20f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\66ad3cf29b5044dc6ac5f5475feb20f0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BF3BDA43-E9B4-474a-A404-5FC1FE4923B2}.exeC:\Windows\{BF3BDA43-E9B4-474a-A404-5FC1FE4923B2}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0767AA14-678A-4c62-87A8-F967C30E43EE}.exeC:\Windows\{0767AA14-678A-4c62-87A8-F967C30E43EE}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6D2AAC8-27DA-4415-8617-B9DA4A4F1509}.exeC:\Windows\{D6D2AAC8-27DA-4415-8617-B9DA4A4F1509}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91014EC4-7820-471d-AC29-965BDD24B7F9}.exeC:\Windows\{91014EC4-7820-471d-AC29-965BDD24B7F9}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC1965E6-27D5-4a80-9B8C-68346062769F}.exeC:\Windows\{EC1965E6-27D5-4a80-9B8C-68346062769F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71504ED1-98B3-41dc-9756-9D1EDD45D354}.exeC:\Windows\{71504ED1-98B3-41dc-9756-9D1EDD45D354}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1230DBB6-CAEC-4c55-97F7-12FA2415057E}.exeC:\Windows\{1230DBB6-CAEC-4c55-97F7-12FA2415057E}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{25F81C27-6CBB-4cdf-A4D3-23C8E6376A59}.exeC:\Windows\{25F81C27-6CBB-4cdf-A4D3-23C8E6376A59}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A9EBDD5A-389F-4ce0-83D9-8E9E47D3786E}.exeC:\Windows\{A9EBDD5A-389F-4ce0-83D9-8E9E47D3786E}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8A317FA9-71F6-4fd5-8C47-470FA037D3F1}.exeC:\Windows\{8A317FA9-71F6-4fd5-8C47-470FA037D3F1}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1D511BDA-3411-4379-BBAE-DCA074A30CE4}.exeC:\Windows\{1D511BDA-3411-4379-BBAE-DCA074A30CE4}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A317~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A9EBD~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25F81~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1230D~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71504~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC196~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91014~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6D2A~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0767A~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BF3BD~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\66AD3C~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD52c47514af8e436d73e254a55b7728e97
SHA139699b737dc450501b19f6e9eddbe311b957e5c8
SHA256a3b94a594d4202bc45841980cbc4c9206c6ace5528de1e042841d4823babcd92
SHA5124265963a111f81b4cc3069fd1a8e72845d69d131311c6de82a3292424265e747c063530eb563e2cc3329eb6b329fc1c931edd4fd1d247bcc62788364d815bc83
-
Filesize
90KB
MD559764be0fa64fa0ae088d5755160b97c
SHA18af241c298c4a66cd79a5e231adad52d54958ac1
SHA256fdff7ea1ba9570b031d8a0cca33fe4606cd992b40fb21a0a6cb978659c8c6dee
SHA512708c84687173d8e6001390840c27fbed77960ad4a1b3983dfb4b7bfed0fd90e7856aafc9617df151a0c523627634a92aa0459f938d2132fe146f799601a78ef3
-
Filesize
90KB
MD56a5aadc8e60cd743e2a74f38b401b469
SHA1461e373de3476ace1d96244b05f6eaa8be1c6a3c
SHA25635ddb1b6d0ee59b055019d514b18892c2a40c1b0c948d6c1ebc9685d6edb1310
SHA51204cb2de0ed11d0751f817ab834a54c19eb655538d501d694b69f89d920b4f47c0ea1df20f30357a5eb65a391cedc634495cc965482e1fc21cc40ddee6e614d30
-
Filesize
90KB
MD58b2a8b3f4d22650bc3627df52cf4c0dc
SHA1a616bb37b4add5273f8cb0620299dce9bbda4e94
SHA2564d24a97f2627e431552c38dcf47ebc5ef5b61c9a17146d6aa3df5ccfb651ee23
SHA51203e27b8baad253088b3d5111c15b6f4adceb23050f2ae5d7273d3960a4a5540a08a3e14b7ba05a418f972df290cd74c3c0cc3bddcb3c51f34515947b1bc01539
-
Filesize
90KB
MD5aecab96b146ec857ce416fe8d9f314da
SHA18939fc43d0235e814727048d82680d01122258f7
SHA256132c905a41fe06711cf53315ecfa763720fbb328d8ad60a223187e47e2b3b11e
SHA51232897960c8c6b86997932824cdc32a6d01041f6365c6933ee7eb7e88b0b8f3378cd1018584cb8f45ffdae57cddad4e23f6b3b900e78bce508f2276ffe0f6d0d6
-
Filesize
90KB
MD5fd983c76231bf1c224b92fc3922d0d07
SHA16c8ea2fa102df6e30b592531ac388445163b2d8f
SHA256b0c1ac84a2eda20d3490ff7f12bdb4a18ec235b92c36dc69ec4c33f0ea7a3c85
SHA51205d3cc6f3acbabc41f18d951bd9ad9df82ee5676d2a81cac79ff66b01b009a0e0dd61f7ebce5b95235aff811731672c748abc6611c9e85e2b199af6eb9076174
-
Filesize
90KB
MD5900cb3e2bf041c8f0379ae228a566afd
SHA1ff8e21607caeaa944e5ed4fc3dd21f47ae3e09b5
SHA2561cbf2b8eab97477bb1b3d9132f5515ceaf2218f3e6ecf80b52196ef0906704af
SHA5127d85ecb15e810ec1f4bf01f0f8fd1a7331968d6195f27b151610f6de94e150a11a05eb8d9ffbc0115efb9ccfac9b01e601ab9e6138314b0ea6635e0530b4ce56
-
Filesize
90KB
MD549d5f7ce0ad481c9efc2ad92e2f004fe
SHA14a0d257c6353445e4a8f250f67b6333af8fcff19
SHA2567579e6c0a9cef17c58e17ab9db3da0305f5049f420968df09a4a591d0f0f0ca0
SHA512930b15ee35bb5c1311e7a93bec18e70f37da7edd13f3c236d54b73dbfda51bcdea3334f2cf8510432b1bfd2720680069e1a3f71c181ff8465f246fcdc94a00de
-
Filesize
90KB
MD51b4f4a7b34042cfda2ff75631184aa01
SHA1ff5a1a6a1f233b6c38daa3b0f6ccbfad0d900c7b
SHA256f14defbbd85a95ddda3d05aa4f913d28fe3afa9ac83169d0241d7751fceaccdb
SHA5124e730387d6010f4decbf8ff6f84495f783da12b7cf7f1b255bb6d10c998a34ec7af45fdb38e27c10fcd1e7fb2f722d01f5cf23300b310895ed3524d499b910d9
-
Filesize
90KB
MD538e6e2244b6a8f1c9ba7d3fcb99dbc17
SHA129bc7c7296b396f5fc733f0b63351cc6fb62fbd5
SHA256daae16c6d14c16717c29b295e90a410ac34dc662444f4bcb724d9cb8b03f0e6c
SHA512d290d3b4669788b5cbc5d92cd71fa6f171a540fe754e182a7c03ef67f6e946f82043156ac496aea914b0d7ff7cf41d859868b18c7f1b7f6764c4283bb2bc6781
-
Filesize
90KB
MD5d72725f49f2c6cb93cc053965fb86fac
SHA1607445ac08756a857e218867d261d217ad4239d7
SHA25675811069068c485d87280499d0fbaa3208a36548191d6d2017ae044cc5a01446
SHA5123e8404cb9a37d19390404ad57cbe0751631295fca50ee1f06f854f2e580a8ed7c1c0bf34b03eae249e32070be7daa400c9bb0b97edac3bf56112e9a689b86769
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB