Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23-05-2024 01:07
General
-
Target
691cb70e8509a4f1ce5e20ad271137a0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
691cb70e8509a4f1ce5e20ad271137a0
-
SHA1
bad95b009ed12cb959758b3f610f14e875183af0
-
SHA256
eb8576af91f370e924bfefe2e618f351751563efda768517f937bc2cb1e6da87
-
SHA512
e6d21effa115d9802a35ed426cfc0cadc1a0f42040005a79e854af6b158329fabb3ce9f97a3e2bd3ae4460932c2689e165bc81c5c67140c8a6f471be54984f9d
-
SSDEEP
768:5vw9816thKQLroX4/wQkNrfrunMxVFA3v:lEG/0oXlbunMxVS3v
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\691cb70e8509a4f1ce5e20ad271137a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\691cb70e8509a4f1ce5e20ad271137a0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E16CBFF-E936-4c2f-B3D3-984FDA377FF6}.exeC:\Windows\{0E16CBFF-E936-4c2f-B3D3-984FDA377FF6}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D25C7CD0-8E33-4c80-991F-F078D1380ACF}.exeC:\Windows\{D25C7CD0-8E33-4c80-991F-F078D1380ACF}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3864558-177C-48c4-8198-F6D1A21CB29B}.exeC:\Windows\{A3864558-177C-48c4-8198-F6D1A21CB29B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD99E0F6-4A33-4146-AA65-FB35825CA24B}.exeC:\Windows\{FD99E0F6-4A33-4146-AA65-FB35825CA24B}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96660445-B3AC-40b3-AEFB-79E7CEAFAE14}.exeC:\Windows\{96660445-B3AC-40b3-AEFB-79E7CEAFAE14}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CFC92F8-7F60-4024-9C85-721152993219}.exeC:\Windows\{0CFC92F8-7F60-4024-9C85-721152993219}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84C4DEC0-D988-432a-A211-56DEC2C02D76}.exeC:\Windows\{84C4DEC0-D988-432a-A211-56DEC2C02D76}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{030BBF1B-DA1F-4b98-A2AB-5F82EE254F8C}.exeC:\Windows\{030BBF1B-DA1F-4b98-A2AB-5F82EE254F8C}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{543738F9-E592-4339-B761-838C4CE49035}.exeC:\Windows\{543738F9-E592-4339-B761-838C4CE49035}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DFEB9F6F-B43A-4ae8-9493-DA510AA04114}.exeC:\Windows\{DFEB9F6F-B43A-4ae8-9493-DA510AA04114}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{94F56B6D-A3C7-4a9a-83AA-E54C893F9483}.exeC:\Windows\{94F56B6D-A3C7-4a9a-83AA-E54C893F9483}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFEB9~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54373~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{030BB~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84C4D~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CFC9~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96660~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD99E~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3864~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D25C7~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E16C~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\691CB7~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5711c60dbfc6464f229ff923c72743ffe
SHA1383b7940ae2cbb66467d95c8faec489759671d72
SHA25649a866923d8986077fe26c95b48d4cf48e39815e33af0d70a250bd1d95476912
SHA512bf6955b7eac2f382ce64f909afd125409506e4f174939d7a16a7e5a8e8e47168afac5832d11b95561866c14f297ca1099b678dbe647726dd13e02f26e1b144e9
-
Filesize
89KB
MD51f420c367e695fa257e532b21fefa494
SHA16a1615ae068156f79bb561f74c76d8f87d27a655
SHA2563a563eb43a39e6aa95ac11f303a6f22fbee1765aeabdcd55ab7643e8632a564f
SHA5125b17da1d556d8ef8effb872ce05b537f26e7e6538c2f9ca6a87f28c04a34ce38da1023278b22dbceb990b770940cea4c3d31f5ff433c85bcf6f66c4826d7b0a6
-
Filesize
89KB
MD5cf0dd36e83d8f6324244cc915b3bc3aa
SHA13c3e7f8528fa929c886d46cae8b7cfe2e2947c89
SHA256858ae27fae2dc7e351cb570f5bf774e13e21340cc5501480acf3549c407e8b96
SHA512367f0cdc670cb11dc2bb0165a195ff06d873f08a8623a8ef96f188f41b5f07b9d7bd3911731465f38fb9f9ea2cf016f764de8464751f97e3145984ba5ca5328c
-
Filesize
89KB
MD54a8e50d53aad0c770b14f259552fe87d
SHA19475f4688f49897e58711aa05427466fbf78db06
SHA256b831fccac645195a1bd4e7ca37e751d31c19efeb5891adbda6bebe300605fcba
SHA5120719f6f2f20f898374c295ee7265a8962e2e54d4740073df760934214e0650b55c89854040a9a7aa264f3194e716cb447e2874ee7ae29f914e95f1878b0af9bf
-
Filesize
89KB
MD591ca94f29a160836585865a4f0b72cc0
SHA13ff54a99fe7bde72d514dd4b1ace4fc886b0e729
SHA2568c6651dfabc319d00bb4268ab34351cfd01c49c806e5c58a4f1a00b35c90dcd2
SHA512bf5e1ff86903f77115cf8919458679146de8723ed332cb446d4c6ae6bec6d87a90bdcb1c92bebecd4690f351aec7e0b429dae12bbe93bf514da54382567b148d
-
Filesize
89KB
MD50bacf57265cac3533c95f8fd532fd30f
SHA18ee884faf47830051eadf38252442f8092f9bbc3
SHA25669db3768dca7c725e6f4b71f89ecc758b79ce823ae0757c4d0770451e7115e64
SHA512217a571ee162dd15664f307cf0f724c70841c0bfcc753be495aec8a766d016335db16febf677609abdcae70fa8ada531be22efe7fdce5c836e132cb47bc9aa00
-
Filesize
89KB
MD50020723a0082be10867fd7904f46a6fc
SHA158c4a03c9c7b72fe1b52a78ea07bdb67c4be642c
SHA2564a2549f3ee2f95195ff83f82051fee6e651906123d74edce537b78746c1f4497
SHA5128c8b329888f2c11661d2ee4190f8ecc254734ca48dca55d603b87ee113714bb09bc68d7aca8881dd65b91248f25031e48d303be043f32eda3d25db170f707af8
-
Filesize
89KB
MD565c4b86dae97a3dbe97391c0d62c6485
SHA13c5b9ef0bb5d059f4ce738bb2b0eee99f8612e18
SHA256f784f1f4effdd16fc2580b9b04dc33a8aff5f5bfd3233ac8e10dd882f0c8cb94
SHA512d5a41d97cee9371833808c72caae7a8dc067416e04d4e784a9159baa2c0e3fd5f91e4b3bc4ea0219cb4273541c9303b5008aa6c5194959e4e8b827fc1afcf7f5
-
Filesize
89KB
MD57c95d6db92df24d8c1714fd6168f1a5a
SHA1baf748965b91a108c53813caf5e8c883f0d54a25
SHA2567360c00be44ac51ca29552deb82928158044863314381f38ab7ecdf7907de0bd
SHA512b7d1329a370e2e7d371d062fdebea2321e97bb901601a54d08e3aff3d0ce426ac50aec0959c3212726f1e6286e6439a31203070ceae11341070fd89ae098a75e
-
Filesize
89KB
MD5b9b7b395b88819956765fa3645e81265
SHA13e2a0d24293dc1404ddbf22aba9a40c1f7dd367e
SHA25670e709b9470514a6cfbae0eeee45b134a873d94f4e48ae094fe181821847b34e
SHA512c028b8c9395ac0ca73f42aeb1470fc4d10b9dbf0b9a5fda01399cf48fb2b797e0c23ed3adb0f9a6a0c56ea226bbf13f10a067d1d5b95d09f2ac125d98c1366c5
-
Filesize
89KB
MD51a0346cc1cb87a3599bcc315d3c6a0b3
SHA1f72055f6ec61b62d0b769532da26bbf9272e694e
SHA256435dbf767bdf7ff4c04ccfdb748440ca183ef4c3ba42a598099b45dca0dbde12
SHA512b2a9b6f77f1e110c4a9875495cf61fc4a990e865af95a23573eb41b1f946024da378f2e2d88a0269f937e2766980dbd313683358aa82ab31f97ed30a482c37ce
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB