Analysis
-
max time kernel
18s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:46
Behavioral task
behavioral1
Sample
70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe
-
Size
497KB
-
MD5
70d2c3e8fce7be5c136f57327b699b20
-
SHA1
6fbdc1ae7b4a79d1e60b559c055013ae6a1283c0
-
SHA256
d45a5a3fde30002383d2c69dbcfbf529344c56f18414833b5baff6bbb5d884ee
-
SHA512
789e436517ada4db2759acf66ca03cce391f779a68c2b202636a4f9e64c5e9cf0d981d42ddc45ded7f96139f1b271cb1ca8baa70a6bf521a2259fef9329ba957
-
SSDEEP
6144:J89MA6jz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fay9:+w1gL5pRTcAkS/3hzN8qE43fm78Vh
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
MSWDM.EXEMSWDM.EXE70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXEMSWDM.EXEpid process 1276 MSWDM.EXE 2560 MSWDM.EXE 2564 70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE 1124 MSWDM.EXE -
Loads dropped DLL 2 IoCs
Processes:
MSWDM.EXEpid process 2560 MSWDM.EXE 3020 -
Processes:
resource yara_rule behavioral1/memory/2600-0-0x0000000000400000-0x0000000000418000-memory.dmp upx C:\Windows\MSWDM.EXE upx behavioral1/memory/1276-9-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2560-17-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2600-15-0x0000000000400000-0x0000000000418000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE upx behavioral1/memory/2560-34-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1124-31-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1276-35-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exeMSWDM.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
Processes:
70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exeMSWDM.EXEdescription ioc process File opened for modification C:\Windows\dev149A.tmp 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe File opened for modification C:\Windows\dev149A.tmp MSWDM.EXE File created C:\WINDOWS\MSWDM.EXE 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MSWDM.EXEpid process 2560 MSWDM.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exeMSWDM.EXEdescription pid process target process PID 2600 wrote to memory of 1276 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2600 wrote to memory of 1276 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2600 wrote to memory of 1276 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2600 wrote to memory of 1276 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2600 wrote to memory of 2560 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2600 wrote to memory of 2560 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2600 wrote to memory of 2560 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2600 wrote to memory of 2560 2600 70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe MSWDM.EXE PID 2560 wrote to memory of 2564 2560 MSWDM.EXE 70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE PID 2560 wrote to memory of 2564 2560 MSWDM.EXE 70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE PID 2560 wrote to memory of 2564 2560 MSWDM.EXE 70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE PID 2560 wrote to memory of 2564 2560 MSWDM.EXE 70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE PID 2560 wrote to memory of 1124 2560 MSWDM.EXE MSWDM.EXE PID 2560 wrote to memory of 1124 2560 MSWDM.EXE MSWDM.EXE PID 2560 wrote to memory of 1124 2560 MSWDM.EXE MSWDM.EXE PID 2560 wrote to memory of 1124 2560 MSWDM.EXE MSWDM.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1276 -
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev149A.tmp!C:\Users\Admin\AppData\Local\Temp\70d2c3e8fce7be5c136f57327b699b20_NeikiAnalytics.exe! !2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE
- Executes dropped EXE
PID:2564 -
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev149A.tmp!C:\Users\Admin\AppData\Local\Temp\70D2C3E8FCE7BE5C136F57327B699B20_NEIKIANALYTICS.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
497KB
MD5afa5190e0e4a9f12a38c67836bba14e9
SHA1bcef44a9e84d0f1b9344ae250b7d95b15cb39cf1
SHA2562525a795cdccac8885b328c9bdedff4343de2a06838e289b03545774568b5895
SHA512c32a1b1b0942ef6c038b3fe4edb793b643d42e6de7f3be13f3b995878222699af4fa46cbed026fbe69ecd3bd1e37c248f9769e77b9e9a143c6992edb2391c41f
-
Filesize
39KB
MD5808db81803d4419434e881bb42d2c096
SHA144cbbac69c5dbfedb6f2853d12baeb2e750840fb
SHA25685472524ca67962db894afb21001c14722734178410d675d4f76fcccb2958253
SHA51200b44fe56d0f07dac49b8f1586a3e3f7be36b553e9cec6af2ea2ad0f07616d6e21d3c5f794b137d8b16cb2b18be388531db023b237c7fc75ea0d3d8db77495db
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628