a2c4f3c0be9b1aa77584a8baee1c6c2e80f61a14c98f30c584319e05f15ab508

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe
Size

440KB
MD5

6389b3c3e4c62fbe1335f91ad2ea1000
SHA1

f33d1f8fb8e5cbea7ade4b291f4e6a2eb1ce62a1
SHA256

a2c4f3c0be9b1aa77584a8baee1c6c2e80f61a14c98f30c584319e05f15ab508
SHA512

156ee36993ad5ad92b5b1fa38e5f6aa2544c015769ea1240082f98de744d7ce9842b49825c6bc750bcc7b252cbf605c6eb019cf68e552b4ff4ba6f07881e8bfb
SSDEEP

3072:953mQkJtnP5I09qgmBBAWgjSvwF97Ghm94b:rmxJtna2qgmBNgQwCr

Score

10^/10

upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

1160 jusched.exe
Loads dropped DLL 2 IoCs

Processes:

6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

pid process

2388 6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe
2388 6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

pid	process
1160	jusched.exe

pid	process
2388	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe
2388	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2388-0-0x0000000000400000-0x000000000046E000-memory.dmp	upx
\Program Files (x86)\e06da008\jusched.exe	upx
behavioral1/memory/2388-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2388-11-0x0000000002A30000-0x0000000002A9E000-memory.dmp	upx
behavioral1/memory/1160-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1160-16-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

Processes:

6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files (x86)\e06da008\jusched.exe	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe
File created	C:\Program Files (x86)\e06da008\e06da008	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

Processes:

6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

description ioc process

File created C:\Windows\Tasks\Update23.job 6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe

description	pid	process	target process
PID 2388 wrote to memory of 1160	2388	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe	jusched.exe
PID 2388 wrote to memory of 1160	2388	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe	jusched.exe
PID 2388 wrote to memory of 1160	2388	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe	jusched.exe
PID 2388 wrote to memory of 1160	2388	6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6389b3c3e4c62fbe1335f91ad2ea1000_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2388

C:\Program Files (x86)\e06da008\jusched.exe
"C:\Program Files (x86)\e06da008\jusched.exe"
2⤵
- Executes dropped EXE
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\e06da008\e06da008

Filesize
17B

MD5
4d77d6b250ffb567743b8dbcdad695b8

SHA1
d5a8f98f9433f6d36c74df463cef3e2cf524462d

SHA256
7ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2

SHA512
5655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71

Download Submit
\Program Files (x86)\e06da008\jusched.exe

Filesize
440KB

MD5
7ec80511021d3036bb4226811e8f1373

SHA1
03b04acea138747776d1587f932558a2a16d06f6

SHA256
725bf673de1daa5a595ee5dce31ed6c21095bb98bf72e1a83d2479b208155dd5

SHA512
4466e20cbc3d0649454f68644a5f66afc754c55ed15f22d5cc4a6ac4313054d57f70f85be69e15e58bd37eb77029dec6dcffc7ee2bf24d27b4f934006447c602

Download Submit
memory/1160-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1160-16-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2388-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2388-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2388-13-0x0000000002A30000-0x0000000002A9E000-memory.dmp

Filesize
440KB

Download
memory/2388-11-0x0000000002A30000-0x0000000002A9E000-memory.dmp

Filesize
440KB

Download