44b3c781e61263fd64d999b4bc9f2ebf242ffefc78321a9556b7616bec2be4df

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe
Size

34KB
MD5

6cb80f9f0790bda300e1f22201f4d720
SHA1

4fce37dec7b6a2bcd8a58fa59ccf294eaef71a91
SHA256

44b3c781e61263fd64d999b4bc9f2ebf242ffefc78321a9556b7616bec2be4df
SHA512

a77d946809b99cd23f32a6209d0fa71f8307bf82f423b182113653e065f84603cf5e77427e8b9b79a65c79bb257a2476881aecd927e83e0bfd8d57b29936be3f
SSDEEP

768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhq:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYK

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

microsofthelp.exe

pid process

1276 microsofthelp.exe
Executes dropped EXE 1 IoCs

Processes:

microsofthelp.exe

pid process

1276 microsofthelp.exe

pid	process
1276	microsofthelp.exe

pid	process
1276	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

Processes:

6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe

description ioc process

File created C:\Windows\microsofthelp.exe 6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\microsofthelp.exe	6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe

description	pid	process	target process
PID 2980 wrote to memory of 1276	2980	6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe	microsofthelp.exe
PID 2980 wrote to memory of 1276	2980	6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe	microsofthelp.exe
PID 2980 wrote to memory of 1276	2980	6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe	microsofthelp.exe
PID 2980 wrote to memory of 1276	2980	6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe	microsofthelp.exe

C:\Users\Admin\AppData\Local\Temp\6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6cb80f9f0790bda300e1f22201f4d720_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\microsofthelp.exe
"C:\Windows\microsofthelp.exe"
2⤵
- Deletes itself
- Executes dropped EXE
PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
34KB

MD5
d14d5b6ff03339198aff9f69bfb9d289

SHA1
9add78220b46fe188068323a04f85152bed54c05

SHA256
223dc6d8e8010ce63061cb847c1decf352d49e986722d661644ce65afe90b2ba

SHA512
3d49624a926996f080f6843a08d9883298b53c3f6d9aa56b36fef75cdb99ba78d5fd9d630be4dd134cdddbfe7a5557b8f05a34a353fc891bde808dcf4651d5f6

Download Submit
memory/1276-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2980-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2980-3-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/2980-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download