Analysis
-
max time kernel
149s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 00:09
General
-
Target
5ee65e499276e5d1a8421c67f7505180_NeikiAnalytics.exe
-
Size
248KB
-
MD5
5ee65e499276e5d1a8421c67f7505180
-
SHA1
6d878ef2b8ebd59ecd706376c1ceb18d7a9e4477
-
SHA256
98c4769c22fd1bbadd31e701dbfbb944375d7502346bd0bf5befd172f814ffa3
-
SHA512
5bee4759b938cf81c74bec184de2ee7141a452f93204613932a7e0a59bf07ce9fc343cf32baa2c3484d76ac8106d02ff9faa49d7e37b72ee07f365d546e5de6c
-
SSDEEP
6144:weQ1WRHtMJrCBC0MpUYlxbwa+S3SIYtCHOEvY6:w0HtlCDpJLD+SCvtCu0Y6
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\5ee65e499276e5d1a8421c67f7505180_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5ee65e499276e5d1a8421c67f7505180_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\contndue\agennify.exe"C:\Users\Admin\AppData\Roaming\contndue"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~3836.tmp3432 254472 3640 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 5603⤵
- Program crash
-
C:\Windows\SysWOW64\findhost.exeC:\Windows\SysWOW64\findhost.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 24441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
248KB
MD581703f0ca3153ad217741be084c57331
SHA154888a43d407580c8200c2364298e142a7f05081
SHA2569627feb1ea1e20232c43b302892a1d58a94dcab0d00b06c18e466482b98d9885
SHA5121596da7bd3c0969d58e81522c4eaee683d39f621c030738274bee13e6e50b01934881dfd111a3e29630bfcf5c1e671678bd249104c8ca8d07eaa4a7f6f727656
-
Filesize
288KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
288KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
24KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
52KB
-
Filesize
264KB
-
Filesize
288KB
-
Filesize
24KB
-
Filesize
264KB