Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 01:31
General
-
Target
6df919060f9b953451c8ba6f17c1f080_NeikiAnalytics.exe
-
Size
135KB
-
MD5
6df919060f9b953451c8ba6f17c1f080
-
SHA1
e3cbed7d5b1e637975893877285e2154f2bd4027
-
SHA256
a2841305b0bf7b5c45ca94adc641730925b7a7cb629aeaa583b984bfbe41e1cf
-
SHA512
8d938c0b0ae8f3588e8a2a726c87d27b28160372a3fe167a32378bb4a7e27ff9499c2df9ee9b8871e883ea4aa9fefcc7a0eae82047e2b2acee2e3e87ce416f83
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVvUG:UVqoCl/YgjxEufVU0TbTyDDal1UG
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6df919060f9b953451c8ba6f17c1f080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6df919060f9b953451c8ba6f17c1f080_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5394e0cd1c811c9ad3f42cbbf1458613b
SHA1e77563e0e8ab00e03e2421f5e5792f06615da346
SHA25649acd8ec0e29ff12aa5d4e6e5f21b906221f9fa182d0b05f53727d7aca87fce9
SHA512216a1277f8682a2f22ca9a697170a6d84a2b04657afef39f9d3393f262c5f553b00e4c95851aed578d7c5e2b92f0318b090938a68322cdaa7d9c0f10276ac74c
-
Filesize
135KB
MD5900eff2a7cdb1718b2f8e3cf89218b61
SHA1582c35a40059e563b296ed939e30ba3aa8c69212
SHA256b98e966c19a6a009ae2a06d8c52fd8288d8b6a52c4f261c4dc06e1e79e5df1e9
SHA512cc6855ba84be6a0bd4a3451591f1802f68295f9db4937a2a7903100082aaabbad68b00bb68f0718885ee555517e90b8c3323d676fc2ed13d5cd62dca852d826a
-
Filesize
135KB
MD5de179d89e0c901517b87328a0d85760f
SHA13adc0e5b4eb1d7dae06a7390f9c10f29d5c5a962
SHA2564f3055964ba96f4af84c3d3967d349d83952373b1bd842732917f31385115616
SHA5128d598b89128d8aa8b3a9901361631c190d8a9bf85cb45d7053c9720e6c044accbaaf70229420e617b608024a46502d30c3d8c97ac5f555189c5ae2d905c79b0e
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB