Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
23-05-2024 00:09
General
-
Target
5ee65e499276e5d1a8421c67f7505180_NeikiAnalytics.exe
-
Size
248KB
-
MD5
5ee65e499276e5d1a8421c67f7505180
-
SHA1
6d878ef2b8ebd59ecd706376c1ceb18d7a9e4477
-
SHA256
98c4769c22fd1bbadd31e701dbfbb944375d7502346bd0bf5befd172f814ffa3
-
SHA512
5bee4759b938cf81c74bec184de2ee7141a452f93204613932a7e0a59bf07ce9fc343cf32baa2c3484d76ac8106d02ff9faa49d7e37b72ee07f365d546e5de6c
-
SSDEEP
6144:weQ1WRHtMJrCBC0MpUYlxbwa+S3SIYtCHOEvY6:w0HtlCDpJLD+SCvtCu0Y6
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5ee65e499276e5d1a8421c67f7505180_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5ee65e499276e5d1a8421c67f7505180_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dispnger\colosort.exe"C:\Users\Admin\AppData\Roaming\Dispnger"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~1F53.tmp1196 254472 2676 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 2523⤵
- Program crash
-
C:\Windows\SysWOW64\prineown.exeC:\Windows\SysWOW64\prineown.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
248KB
MD52fcef6e5c86b0b89d741c126522338e1
SHA17f77a09065a5d1be26262bc73c626c31d3b7b202
SHA256e7309c72fab04b59b680e82f3ebc0a5d600817b9ee73cb114e259e0c1b640455
SHA51269650371a79a60bc88d8a15c7484908f81525d4ee83b2252f98f2a3cdaa7b6daadc7ff8a3d708ea690f6bdebe628a619c4263f52ebf98a9ff3e5103ffcbc99c3
-
Filesize
312KB
-
Filesize
52KB
-
Filesize
312KB
-
Filesize
24KB
-
Filesize
312KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
288KB
-
Filesize
264KB
-
Filesize
288KB
-
Filesize
264KB
-
Filesize
24KB
-
Filesize
264KB
-
Filesize
288KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
264KB
-
Filesize
288KB
-
Filesize
24KB