47fd23c64ada0daac6902cb458fc8c37713a2ebf0356cee5389eb7e01b366493

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69039221cf5f8afe917287162be1d230_NeikiAnalytics.exe
Size

408KB
MD5

69039221cf5f8afe917287162be1d230
SHA1

06be93cdaad338ef387314a9e1b71bef53127ac9
SHA256

47fd23c64ada0daac6902cb458fc8c37713a2ebf0356cee5389eb7e01b366493
SHA512

f15f4ac765f931c5ae21e8834a56edaeee5ecc8f593e1ce297be05783484e10560667f43da877a0c447983b8b72ac8eea043fcf9e4f37228abed1f88eb97a7a2
SSDEEP

6144:4jlYKRF/LReWAsUy1n+7yzJfeGWPAzFdCDrKatDg4iZ1z:4jauDReWQyN2GzhdCDrbt30z

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ibghdj.exe

pid process

1292 ibghdj.exe

pid	process
1292	ibghdj.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ibghdj.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\ibghdj.exe"	ibghdj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

69039221cf5f8afe917287162be1d230_NeikiAnalytics.exe

description	pid	process	target process
PID 1800 wrote to memory of 1292	1800	69039221cf5f8afe917287162be1d230_NeikiAnalytics.exe	ibghdj.exe
PID 1800 wrote to memory of 1292	1800	69039221cf5f8afe917287162be1d230_NeikiAnalytics.exe	ibghdj.exe
PID 1800 wrote to memory of 1292	1800	69039221cf5f8afe917287162be1d230_NeikiAnalytics.exe	ibghdj.exe

C:\Users\Admin\AppData\Local\Temp\69039221cf5f8afe917287162be1d230_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\69039221cf5f8afe917287162be1d230_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\ProgramData\ibghdj.exe
"C:\ProgramData\ibghdj.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DumpStack.log.tmp .exe

Filesize
408KB

MD5
ba0477d1366e170d048aca5335725aec

SHA1
051f3e9d80a9c8d5c40e9d6b1a67b7271ae5045d

SHA256
b539708e6a645b47f9a23ae5b80047f1e127b648b74ed2089852a03e6663eeec

SHA512
716cd7abaac05e9073bbe002b727400e898d93e3677f556012a772f116d217bc7335ebc2c336052699c2a7813466bf176d8aef052e06460a6510a1957ec665da

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\ibghdj.exe

Filesize
271KB

MD5
235d17035c585685056f928f23e553a2

SHA1
9075a630669e61219c428dc9079476b266178536

SHA256
680a6b8d1dc686dd08183112375023c2f9aefbb00380ac6a4d966e2af698258e

SHA512
684022c0434e5c5ec4fc4307e04169cb013a94620ed6f25ba87c78a4e233afa755a6d050190941b31efbae8439bba95ab1ce04e1bba349964e209e72b33d26fe

Download Submit
memory/1292-42-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1292-136-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1292-535-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1800-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1800-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1800-2-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1800-19-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download