Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23-05-2024 00:31
General
-
Target
627fcd77b202ba5704cd6c800e4f65a0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
627fcd77b202ba5704cd6c800e4f65a0
-
SHA1
aadff672cfb0237f4e48cd60b607c9de23b5c732
-
SHA256
1fad62acbd7d4310c724c7395695025bcb09a1d96ef3b69a63f5b5089c218641
-
SHA512
bf68aa9699581c9fed4d4db001465d53ac95099538c196bbddea6d1222d516bcdc8673ccc07082eccf486599e05a51c89e55f64adbe31cd11ebc4b4b489a17f0
-
SSDEEP
768:50w981IshKQLrop4/wQozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzS:CEGI0oplVunMxVS3
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\627fcd77b202ba5704cd6c800e4f65a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\627fcd77b202ba5704cd6c800e4f65a0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92BE78FE-DA76-42fc-8B53-0260A2A2D978}.exeC:\Windows\{92BE78FE-DA76-42fc-8B53-0260A2A2D978}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C594254E-F600-4217-9FF6-2E1DA2192AA4}.exeC:\Windows\{C594254E-F600-4217-9FF6-2E1DA2192AA4}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5721AF3-5230-4683-A54D-5A01A70F8A84}.exeC:\Windows\{C5721AF3-5230-4683-A54D-5A01A70F8A84}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB1D2D0D-E9C2-4a89-9FD8-E7154ABB00B2}.exeC:\Windows\{AB1D2D0D-E9C2-4a89-9FD8-E7154ABB00B2}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{736F532F-0C72-471d-B9AC-7189F0AE3F07}.exeC:\Windows\{736F532F-0C72-471d-B9AC-7189F0AE3F07}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15456322-8880-4f1a-8D2A-1DAC8DEBF2CA}.exeC:\Windows\{15456322-8880-4f1a-8D2A-1DAC8DEBF2CA}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B71AD4A-DD56-446e-B839-503F63838C8D}.exeC:\Windows\{4B71AD4A-DD56-446e-B839-503F63838C8D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA4C9E57-3804-4691-8535-E3145B0A39CA}.exeC:\Windows\{DA4C9E57-3804-4691-8535-E3145B0A39CA}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A5822814-4187-42eb-AB47-AC12CD6128B9}.exeC:\Windows\{A5822814-4187-42eb-AB47-AC12CD6128B9}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B4BB5753-E29D-4ba3-AEC5-780A3641110C}.exeC:\Windows\{B4BB5753-E29D-4ba3-AEC5-780A3641110C}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{92C1486D-F2CE-4483-87CA-96467BD23A61}.exeC:\Windows\{92C1486D-F2CE-4483-87CA-96467BD23A61}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4BB5~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5822~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA4C9~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B71A~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15456~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{736F5~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB1D2~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5721~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5942~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92BE7~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\627FCD~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD596f22d93cea6e03cb6e1958a0ebe3255
SHA1ac1d758852fb74313508758a5a378c7fc3596116
SHA256de2ca752ac2995312c90bf4713ec15057319fd1ca8b656148ea002919fd7d8a8
SHA51273bfd7c3caa0bae91ca57ed137e2d51919e647a724c4342f80322c45296bb1230ddd10df0276f059b2d798d9e2670e057818e9832b1b184af38974558b838495
-
Filesize
90KB
MD527c196d2ff14236a2ef1ab8a8bb4254a
SHA1e11b5d4caf136013cf9893b235ffae39a52cbbc5
SHA256a2e6c3214168cbc3c34644519f1263886080db4cd9f9103ac638a07076975a56
SHA51208e025425b9b0e73975dd5bf9836468f34ce77791d675f30989714a74cec7f1d23e121d6ab90bafc50f193229a5b2851c825a8a048065b392bf467a9b7eba1a6
-
Filesize
90KB
MD55ca0e4131e143435edc183c6ea491764
SHA1830451d73c9a46bbdada92268e8699e517ae041a
SHA256edb0a1e9e84e84e97077a1560e2d967079ce550969297f8eec357528974a596f
SHA51291d6deebf8a49ce9910313ec2826db5f6010977293e068c78e198663db768e3f9a316db1b645464805747bf7e0f32fc442bcec7d43cecf4224e4fa9eba4251be
-
Filesize
90KB
MD5c92495e448a9d041fdf60072fbc7153c
SHA1fd4a9d71e1bacf4a15b89459f427adb7fa0325a3
SHA25677e9fb6d305dba6fdfdacdc799b002b0c59289c74a52626e26c839b9e0037112
SHA512950df8ab852d14ae9832f64427807b3e99911064540ec4e28c037ed968da4edc4e337b1003ab30783e58a50338de68ea92939029a6ec5c66f72291ce15cd0d64
-
Filesize
90KB
MD5ca59dcdb827218f5b892e96b8c2ce954
SHA16b4bdaddcda5ce6aba30a9d818e446edcc7a5e17
SHA25604edabb39f8fc790e3d51c520db903b184337dd0241daffdd602b3f436c83b8e
SHA51208371716754c2851815beb700810b02adaf4edab0e54263123c0cfb887aa7664f02309371c7cf1d8baef9ba6512ac896ae7dfe65b06b3b18a09bcf379690fbfc
-
Filesize
90KB
MD5e7af95217c1d7f863976ced71b3885c3
SHA12c7a97361a603fecf96d798b07a808c47f600f02
SHA256babd2919dc716bfd30cc96b5cc743a29cc449f49cb2dac427c330c31678bc3b1
SHA512305fa80e123260086d5c41e0bee884a1ccdee110f126cc3a6777099e2d00ce9ba63b1e05446e80408419784f49e5324c3bdf72a51a45e8d22cb20ffb28a3dd6c
-
Filesize
90KB
MD53af1a7143576e3c0e38ead7cd1c7c9b4
SHA16f0a2f32c43ad637f91ab6fc5bc698a513698e23
SHA25676b9a8ad20f181b11e512651ac997312b07eb16fc5b0d50fd251c5b35a5e008a
SHA512be3f9c73e7a001a8921e38fbded7cd3507ef5980b004067618d7c8155441698a71eb1b60310c52a554384a4ca7fedd8c7b8c92a5bbc91d1e470d3f31f674347d
-
Filesize
90KB
MD58e5b596d59eea636ac65d337e0dda043
SHA15da1000780791d6eb39b1f67b3807c389a0ef600
SHA25600e3fa4729da6263c5755fb379cc5b67cf9c04e1823947a3d8d10e350965e960
SHA512e8ad0099267dd3c49f2bf667db082a8500aed8a03487dbdfb2ff3a97cf6c43b67b3ba7cb6b6725b55ed7dc0088a55ad189fcec281b5d698fc0fd8cac49ccc7cc
-
Filesize
90KB
MD53bec3b7dc87071747e13e36ee4481ccc
SHA1bd2540aae35d22d54f2cfbc91011452149b896d3
SHA25687005aa23c979b7cd9004ceb4dd1d470a01f2286d18c8890a656758bda70d383
SHA5122d0ab281c5b79a68ff0386419013e5285b0598cd910890468ef286008edabfc8c485699d7d175240cafd852caa834f6e7c1a585efeee61342a03961ca05b834a
-
Filesize
90KB
MD5686b506cab99df5f9e2768f0f3ed241f
SHA1368ddb725970dcc7bc1cbc78d3651e246828cdc6
SHA256a290d4e8cb37bbb3e4abf3f8d9b37e23e761d746d390bbe356d1810738a53dfb
SHA512fab6b75f11c3b643f45526c43f8da5a9748c012b5cc77db87a2cb692f2c2e8806091f64040d3bf955e93f536d99cac6566ea2c7496c01b75e892f586c028e1c9
-
Filesize
90KB
MD5dc253159320c00486c3028a345edaebb
SHA10821a671656301a514cf93e1e468d7d1ace5b278
SHA2566572c267992750ed97e00fd7c16520f1d9d4023e385d72273e4750d0ad7e8385
SHA512c1ad46c488da63a269cd4981501e61e3506801cd16e8557c48a397fe3b952d8010e55c0fae994ba99bd3494d5e14350c3f8ec995cc036a5e9cedea6cca401422
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB