Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 01:07
General
-
Target
691cb70e8509a4f1ce5e20ad271137a0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
691cb70e8509a4f1ce5e20ad271137a0
-
SHA1
bad95b009ed12cb959758b3f610f14e875183af0
-
SHA256
eb8576af91f370e924bfefe2e618f351751563efda768517f937bc2cb1e6da87
-
SHA512
e6d21effa115d9802a35ed426cfc0cadc1a0f42040005a79e854af6b158329fabb3ce9f97a3e2bd3ae4460932c2689e165bc81c5c67140c8a6f471be54984f9d
-
SSDEEP
768:5vw9816thKQLroX4/wQkNrfrunMxVFA3v:lEG/0oXlbunMxVS3v
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\691cb70e8509a4f1ce5e20ad271137a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\691cb70e8509a4f1ce5e20ad271137a0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B103222F-480C-46c8-AF54-9DC922C5AA95}.exeC:\Windows\{B103222F-480C-46c8-AF54-9DC922C5AA95}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5935C10-AABF-4264-A353-DFBE77795A7E}.exeC:\Windows\{D5935C10-AABF-4264-A353-DFBE77795A7E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C80FAA43-BAB0-4172-9ED0-2E0829C6605C}.exeC:\Windows\{C80FAA43-BAB0-4172-9ED0-2E0829C6605C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A572146-C6A0-4657-A8CA-2F3CCB1C8C03}.exeC:\Windows\{2A572146-C6A0-4657-A8CA-2F3CCB1C8C03}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0F0D3EC-E4B9-4ae0-9465-A618DAC08BE0}.exeC:\Windows\{E0F0D3EC-E4B9-4ae0-9465-A618DAC08BE0}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3305575A-ACC0-44d3-9DFF-2515A7B7C45D}.exeC:\Windows\{3305575A-ACC0-44d3-9DFF-2515A7B7C45D}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6BA6BAAC-817F-43d5-9F5E-F7CAFFD7FE2D}.exeC:\Windows\{6BA6BAAC-817F-43d5-9F5E-F7CAFFD7FE2D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2D273B8-FDDD-45b3-A0DD-0E70B59482EF}.exeC:\Windows\{B2D273B8-FDDD-45b3-A0DD-0E70B59482EF}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E28CC931-2A4D-45ec-B3A2-D74381A2CE95}.exeC:\Windows\{E28CC931-2A4D-45ec-B3A2-D74381A2CE95}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EA01F6A-59E7-4c5b-BC7D-F7AD5F6C7B27}.exeC:\Windows\{4EA01F6A-59E7-4c5b-BC7D-F7AD5F6C7B27}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3EDDC05B-769C-4b3e-BA23-A051C4B50C82}.exeC:\Windows\{3EDDC05B-769C-4b3e-BA23-A051C4B50C82}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{6AFD94B9-CE98-419e-B9BC-6A58F39654BD}.exeC:\Windows\{6AFD94B9-CE98-419e-B9BC-6A58F39654BD}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EDDC~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EA01~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E28CC~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2D27~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6BA6B~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33055~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0F0D~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A572~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C80FA~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5935~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1032~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\691CB7~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD54e890b33766b4eb87c298665c3459fe3
SHA101f5cbfc982086379ca151a0a6f15641de91a9a1
SHA256fab4af51bfebe3c91dcbe9940c5c609a4b9ee77f0e210ee8d60605b5ef9fb995
SHA51260df19c28e924df49f59fd02907de8652fc0e26b058a3fe06f1638339558a54337a7678c8476cf50c16310e8701757fb23e324a2decc2a169e28a868ea3d413a
-
Filesize
89KB
MD585e83a7bb3fcec0f208186669bef3385
SHA1c7a8fc77eecec24bde24e98c2fb1286c4b150598
SHA2560ec221fb41582564ab2063dab81429824c50fe4355dc0b4cd983f4412181af45
SHA5126bced10f7e372de4ed7c33e04d6235a0fb993777b0f7cd50693d59afab09b477d77a532bae0106ca99e1bdd1342132114d6cb51214c05954e4a76fefe0927288
-
Filesize
89KB
MD57696ee18c9c06be1831113c83c59f4e1
SHA14446865e9689010ae069c828a3b2ede9e6caee61
SHA256d3a8450b90807b0e944ad4dc6c573f89a755156aae6e255b802e1e4569d81a4e
SHA5128026feea56e5022c584261572e289906a76f2d446398226145afd9e7a931198a866cadd0e208dd9d54c650c68a1b7d7dfaed014546e399f77ceaa0457c3a76cf
-
Filesize
89KB
MD540c96a92b6b84c76bc1357faa093730f
SHA1c7876533c45fb4f1ac850f2ceb2d05a200f5f03b
SHA2560d78158e901cf1b026854f359709ad9313de286cc951a03bb8b7497f12d10454
SHA512d4b40050c7abb333938b5987caf29668bbcf8efc059130575970ff4f7893f2c4aabe2fcea2946b7ce2357219177fecf0e90e8d93aef09ea206a1e571e88e0074
-
Filesize
89KB
MD5b150ef137c80417238d2dc21e7da8b3e
SHA1e7810058898d8e88dcfc14178a8c16f9bac04b33
SHA256c1d921186204262023aaaccb4bf83f323efdec5f48dab891206e9ca9b1b940ce
SHA512564eccea75187e9356be4cbc7086bbc6fdad18644b89bda3ea9bd3dcbb9236e52b22abcad1e12b97014753fa24bb5e19b24308f1a71b971b833f240ff1f12912
-
Filesize
89KB
MD552284f5fdb212c908282e243501a7be7
SHA1f04c1c52d69294740984a064e52daa6475c5c269
SHA2560268ab2fddd8ac19f8a440c802e2c110e887254e67b20bc55546d53f12a18be1
SHA51245679c9a7db22ed730a3951edff8eadec9fa6a0c1fbb4f36c6ca5fc1d532ee59a78dfb885d919786e6aa684f1c9737f751f9074f2ca0c1a1537683cdf570e0f1
-
Filesize
89KB
MD5086f97956636cd290959e7b28dc75ab3
SHA14a9fc0e58beb716f1032e13e865161122687be47
SHA2564d07db81b07b6d58f06d07a4a5da1e21317e3e7832e367bac0e920902d79cb06
SHA5128539e8951c04ea30aa0e19330fc7a9fa42a30a99e82210cf1f3013a55fb0802965d233071502a7f8c13382983d66b03850e31dda9368751c770966a473de75ca
-
Filesize
89KB
MD51696c588cc6318bf405fbe5ab4ab7e72
SHA17fcf1cb839d171c9b7f38d2ea5a5f6c8a08aee34
SHA25667330e6514cfd4599a734c83205ef39b4222f6ceaf8b2126c3d225163d2ca4cd
SHA512010c3c367f7abfaa63930c819101a740436b9a65ceea19c2ed600c67085547d156eee5e25b7e717e1eb9cd1d23a073409fd07f3ca73c91a4c7ffb64f5b2a41b5
-
Filesize
89KB
MD5e7ad78ddd1d4cca1c12849ef42629160
SHA155e66a1eb421072c3011d8e78a12942506be0ef9
SHA256b8cf9f551f49f102a6a899488563c7ca5bcc70dac7f33c7d45f1db046ee919f4
SHA51260d15161a690a041be3f3687dfe40688a647fdb7a3e142ecd0feab398308eaef7c60cb80a420c71aa18ee7c107c48854b9ad7bcb1f9ff2d1fa31ca1f0e121baa
-
Filesize
89KB
MD5f0d6a0f891f15dfb0b0baa60bbbbf516
SHA1f6e51bf354c20624e2bb6dc2a5978d4a7f9051d9
SHA256819e09d95df4836b318b302925cb64a931e75b8bfecf634d9fb76f21295bb48c
SHA512f38f6e1c4267eaa2f22dd05ec9eefb3a3aa4fac2ce93f5dcc70fda54812a7551df8b81a1cf0cf2c8ad02770dac21eb876ebde3a1b860ce690ff91439a98a92e7
-
Filesize
89KB
MD5e53614985e61c8283d15f6140387d533
SHA198d2ca70219ef8081da68ed12497e4c4dd0a3bf8
SHA2560405d3e457d0ab38f3965655a924af2894dcf8d20ef7313d12de52646a67c847
SHA51249a2f486c2aae33da45f9774f4f5aca3a43aaebd35b1edf95d87c91f3366f8a021b129b1b3c776e128e1ee8cf085cafe76fdba412de5013f1af8311967c83edc
-
Filesize
89KB
MD5a9e43f1e8b699d97059808fc39df58f6
SHA1391b00f72ad9c07301b1a19806194ff7a07b1cde
SHA256189994881cac8186cea119e57439344bee307604aec88c893bb895eb5a3e8e32
SHA512d61346d15a31f8fbe237268ede83fffec9b8f5d76eae55be21e77f80d784eef13e4506308098674aac88a4e2f28865287fc60cf055641b0314808c8dfd1c96bc
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB