8a059f6eb13863f8b9d73fa7d07759b32c48c6ada3c831372a70fcc3e4d8ca24

Analysis

max time kernel
148s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe
Size

408KB
MD5

6197afa608e2998c9c06f79c350548e0
SHA1

1b3eb6deee98b2543a9abc6480fd1060db15aec9
SHA256

8a059f6eb13863f8b9d73fa7d07759b32c48c6ada3c831372a70fcc3e4d8ca24
SHA512

bab932be04142fa9e44076838bf0ec853650a406143931bc45f649d1945b8de31a7c8534725ee63cf1d09fb71857df1adabb93760eb225d1937170c909d72882
SSDEEP

6144:4jlYKRF/LReWAsUy039R/UjRBK3JAtM0/kWJJHgsEBR6h+emzow:4jauDReWcujRBKWtp/kGNgsmc9mzz

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

bvogfc.exe

pid process

1328 bvogfc.exe
Loads dropped DLL 2 IoCs

Processes:

6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe

pid process

1340 6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe
1340 6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe

pid	process
1328	bvogfc.exe

pid	process
1340	6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe
1340	6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bvogfc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\bvogfc.exe"	bvogfc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe

description	pid	process	target process
PID 1340 wrote to memory of 1328	1340	6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe	bvogfc.exe
PID 1340 wrote to memory of 1328	1340	6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe	bvogfc.exe
PID 1340 wrote to memory of 1328	1340	6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe	bvogfc.exe
PID 1340 wrote to memory of 1328	1340	6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe	bvogfc.exe

C:\Users\Admin\AppData\Local\Temp\6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6197afa608e2998c9c06f79c350548e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340

C:\ProgramData\bvogfc.exe
"C:\ProgramData\bvogfc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1328

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe
Filesize
408KB

MD5
18cdc040d55584807fb7bee254d3a7c1

SHA1
6e44a66586d95b4967634171d765fb50c70077f0

SHA256
ef8c2f5383e864604e0f2fbed8fcd42a601b00f8f76944028d803fab6674d185

SHA512
308cd43b618ed4e3858c7ac02126f011ed05cdf840e1462ba7447f8d87e5b7eab56795ca15a36c0f19c1d40ce47b8f5dc5bde1e004ced5c24298af1cb8d1f226

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
\ProgramData\bvogfc.exe
Filesize
271KB

MD5
fb3372ff0f1086ebec836c41b2b6e438

SHA1
d214d111c7fd888b2fe2f06b728e685914f77dbe

SHA256
b916ec59509bcb5aaa4e4dff5bf6ee1ef373b6f84154b47e0245bd42773451fc

SHA512
555baef6523f27a9b3ce0768ebce29c3791c051b39d3851d4dd389591909ba7c63133c1c5113f686695f6a2993ead64767d96ef1db5516b67fe0cfe0737d0734

Download Submit
memory/1328-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1340-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1340-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1340-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads