Analysis

  • max time kernel
    20s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 01:24

General

  • Target

    6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe

  • Size

    501KB

  • MD5

    6ca9db9b9460fcc18e55e931edceb1b0

  • SHA1

    689679e228f5e1456109400e8068e5a0711ca9fd

  • SHA256

    88fdd3ce3859dd7040e2c068636913dec2b7b630b4ff88121f1da6dd29d8ca1e

  • SHA512

    855bf823b6885957b3644d981315a972739748e4a57f8e9a16acb8ab5f63fb12f692ff083267d30e820b8d064ca8913190b25e265158bd337358e148867f3a62

  • SSDEEP

    6144:wlj7cMnU+c78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFs:wlbU+285bM3npxYfj63hgD1Zij

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2992
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\dev2877.tmp!C:\Users\Admin\AppData\Local\Temp\6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe! !
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Users\Admin\AppData\Local\Temp\6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1252
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\dev2877.tmp!C:\Users\Admin\AppData\Local\Temp\6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE!
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE

    Filesize

    501KB

    MD5

    517fb47bb2e8bfb841250ce01e5c52d5

    SHA1

    917ddd90ef56450d329d1ba40db26cc6b8a50675

    SHA256

    d208f4ad4f55fcce6322058f18650cd64a5cee58b54b5e5a6a9ca54262f9183b

    SHA512

    1bfc901a0ce86cd64bfb4b25a773dd79da30ed9b971d93c5bb088efcb3a3e518e8c651e08397f00adf0d0cea61d8436957a229b89f7b9a2e43325cc884afadea

  • C:\Windows\MSWDM.EXE

    Filesize

    47KB

    MD5

    2af966e7672f1e9c626245551247fb3a

    SHA1

    e951cfe9ab27dad1f3df6e8189d0cf9b6dbbf66c

    SHA256

    6b493904f292ff29033f7c6570485a7bef4d83eb9a71b2e64b9fc3308017a6c8

    SHA512

    dfa2ae6cf2ff64bb9e3f884c02d348a9e615e94e6cbd05ce8bc98ec98d22dead2b6007e7da9e1d9e2317d53366c58611100146a68ff44526e93ea71d2561c98e

  • C:\Windows\dev2877.tmp

    Filesize

    453KB

    MD5

    96f7cb9f7481a279bd4bc0681a3b993e

    SHA1

    deaedb5becc6c0bd263d7cf81e0909b912a1afd4

    SHA256

    d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290

    SHA512

    694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149

  • memory/1444-0-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-12-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2032-16-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2032-34-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2032-24-0x0000000000260000-0x000000000027B000-memory.dmp

    Filesize

    108KB

  • memory/2660-31-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2660-28-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2992-15-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2992-35-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB