fd1adfdbcbe856e4258d056dec33495cfb35a48eba39988b84f2fccaaacc2dfb

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe
Size

965KB
MD5

6d55da2c1387af5a9dff5cd43d706e60
SHA1

96534624feb0432ccab8c7662e93eb1620e82c66
SHA256

fd1adfdbcbe856e4258d056dec33495cfb35a48eba39988b84f2fccaaacc2dfb
SHA512

54fa11c15f0da45d7251b9a21b0d3992177b37fa52dd034486b9082a1b06d2549c78f71dbf6563a102858fd66f531858add2e1f170a0afcaca6e0c98be3c8a26
SSDEEP

12288:i2ToLD2QfWUEknSsmjj/UVF4TkScNEo/TjMVJK1P5aEL3YFyhxoeVsc:ikuPfWsnnw/UV+kScN9HMVcRaF2v1

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i"	6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

pid process

1872 6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

pid	process
1872	6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:1872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6d55da2c1387af5a9dff5cd43d706e60_NeikiAnalytics.exe
Filesize
965KB

MD5
c7b5abe1cc978dea6d51641cbea04990

SHA1
aa2e0d9660d70835de9a51f6963b65503bf1d92f

SHA256
be95cf71e45e302df1c786628e636456a7386041929698921a3bd7bdd74b895c

SHA512
7e0ff79be21a8ab332d762ec4a0a5d7a8b98be102834c775e753843c9d64db0ec4ee481da9b67c64c8a5efdc9f9d34fdf66965265f58a7abbc295bbfef9b5085

Download Submit
memory/1872-13-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-14-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-3-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-9-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-10-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-11-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-4-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1872-12-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-15-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-16-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-17-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-18-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-19-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1872-20-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download