fd1adfdbcbe856e4258d056dec33495cfb35a48eba39988b84f2fccaaacc2dfb

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe
Size

965KB
MD5

6d55da2c1387af5a9dff5cd43d706e60
SHA1

96534624feb0432ccab8c7662e93eb1620e82c66
SHA256

fd1adfdbcbe856e4258d056dec33495cfb35a48eba39988b84f2fccaaacc2dfb
SHA512

54fa11c15f0da45d7251b9a21b0d3992177b37fa52dd034486b9082a1b06d2549c78f71dbf6563a102858fd66f531858add2e1f170a0afcaca6e0c98be3c8a26
SSDEEP

12288:i2ToLD2QfWUEknSsmjj/UVF4TkScNEo/TjMVJK1P5aEL3YFyhxoeVsc:ikuPfWsnnw/UV+kScN9HMVcRaF2v1

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i"	6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

pid process

992 6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

pid	process
992	6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

Filesize
965KB

MD5
dae65cc707d755701f3fd3089a751adb

SHA1
650ebc75156892ed5070334df579ec46d4c389d2

SHA256
2b607f097ea20e2c06c57906609c024672c67da86569b669515f9459bf42fad3

SHA512
0c1360a9dc5463cf308321cd34bf9193b2889c189e1c24ce2cead66192e4a2f83b9e909c413cd9af0d4fb1eb776ff2adc9693d5d75e78a070ca13ac59e5d1447

Download Submit
memory/992-13-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-14-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-3-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-9-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-10-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-11-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-4-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-2-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/992-12-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-15-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-16-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-17-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-18-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-19-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/992-20-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download