7c20405e420b7beca72ce9a20c4f84455b100ea10ec72b54aa87217dbf83ae88

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe
Size

65KB
MD5

6e37700eb7a25233aabeecae590a8050
SHA1

7167bc5801f48b87ecf4646a1d00257f67a8fcd4
SHA256

7c20405e420b7beca72ce9a20c4f84455b100ea10ec72b54aa87217dbf83ae88
SHA512

4a32bfb9c9e6f1bd78ea3ada086778afbe0269a2c38f9f376ed12e0ee57313813e00d8c418a1be6c214a2eaf92602166616661713dcc7a0dc73caec22e27fc4f
SSDEEP

768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6k:Zr3Z5IfQIR81ad5yX6k

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2696 attrib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2684 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

iuyhost.exe

pid process

3064 iuyhost.exe

pid	process
2696	attrib.exe

pid	process
2684	cmd.exe

pid	process
3064	iuyhost.exe

Drops file in Windows directory 3 IoCs

Processes:

6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\iuyhost.exe	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	attrib.exe
File created	C:\Windows\Debug\iuyhost.exe	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe

description pid process

Token: SeIncBasePriorityPrivilege 1524 6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe

description	pid	process	target process
PID 1524 wrote to memory of 2696	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	attrib.exe
PID 1524 wrote to memory of 2696	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	attrib.exe
PID 1524 wrote to memory of 2696	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	attrib.exe
PID 1524 wrote to memory of 2696	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	attrib.exe
PID 1524 wrote to memory of 2684	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	cmd.exe
PID 1524 wrote to memory of 2684	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	cmd.exe
PID 1524 wrote to memory of 2684	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	cmd.exe
PID 1524 wrote to memory of 2684	1524	6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2696 attrib.exe

pid	process
2696	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e37700eb7a25233aabeecae590a8050_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\iuyhost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:2696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6E3770~1.EXE > nul
2⤵
- Deletes itself
PID:2684

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\iuyhost.exe

Filesize
65KB

MD5
1dff511e0ddd090e43d6365b6d62fb7b

SHA1
2474533ab7d2c0fdb13f1447118e4e8719669540

SHA256
5cfc67c4eb18b364ec19acffaffc00736ccec8eea456e313b308c25c6f85a13a

SHA512
43b714f940ffd5b977be63d619ab4f8c75b305a8ef733d5b9bbb97aeda5af8bd305faa91986dfa2b8f092918ff8427705e476916dcd72ee2dccfd643c9f06e14

Download Submit
memory/1524-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1524-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3064-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download