5d7c1cfec73f61e9bbb14acd9f051a47df0f6121e21feb2caa375e6d60b1da54

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe
Size

81KB
MD5

677098b36fb19a34a206a38f9b6bf6a0
SHA1

8caed62f9977c4600ecefc48dae888d5abd76e85
SHA256

5d7c1cfec73f61e9bbb14acd9f051a47df0f6121e21feb2caa375e6d60b1da54
SHA512

bb6558372fd342a451f315b1f6124a8f9a5eb629d0a80df8ce2be553408c1cd23a6915ae70d70f0bfdae7046117aa7fe6c28a1e53fcf00bd1e4061f7d1cd5074
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1ky7QpG:zCsanOtEvwDpjg

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2380 misid.exe
Loads dropped DLL 1 IoCs

Processes:

677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe

pid process

2892 677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe

pid	process
2380	misid.exe

pid	process
2892	677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2892-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\misid.exe	upx
behavioral1/memory/2380-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2892-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2380-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe

description	pid	process	target process
PID 2892 wrote to memory of 2380	2892	677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe	misid.exe
PID 2892 wrote to memory of 2380	2892	677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe	misid.exe
PID 2892 wrote to memory of 2380	2892	677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe	misid.exe
PID 2892 wrote to memory of 2380	2892	677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\677098b36fb19a34a206a38f9b6bf6a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
58fbce82398233b18494fe5e363f0a4d

SHA1
2183c93b582e02a7258bf19e46ee58db082cfbea

SHA256
9bbbc6e7a259563a9a610ea521fdf9a877ac021bbe3c6f2b4d45f8d62b883f2e

SHA512
44ae95d6aa8d27e41a0203b2ab7bdc20a2156f2fae4291c40753241e5921b67dc3c352d0eb67978db947e901e3bc37172e47d770c67c6c138793df40e2890b73

Download Submit
memory/2380-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2380-19-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2380-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2892-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2892-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2892-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2892-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2892-16-0x0000000000640000-0x0000000000650000-memory.dmp

Filesize
64KB

Download
memory/2892-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2892-26-0x0000000000640000-0x0000000000650000-memory.dmp

Filesize
64KB

Download