Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
23-05-2024 02:27
General
-
Target
77d793f606512c3bf0d1a8af74407c70_NeikiAnalytics.exe
-
Size
90KB
-
MD5
77d793f606512c3bf0d1a8af74407c70
-
SHA1
75a9c4aac851575547e236dc8d852181a04890d5
-
SHA256
37f9e5ac8a55cbbf4c62a66c7fd44ae222461113e09e283cd4f067ca6dced031
-
SHA512
1a822455abbae3e020c50ccc356bf388a4644995011ad64b9a7b2d011c86407b4f4f81b25390778e305e6c9634b8f8a7779150cc2280757093820dd3389a7d90
-
SSDEEP
768:50w981IshKQLroT4/wQozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzS:CEGI0oTlVunMxVS3
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77d793f606512c3bf0d1a8af74407c70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\77d793f606512c3bf0d1a8af74407c70_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{238A57C2-927D-423c-AC11-F6D553E7F301}.exeC:\Windows\{238A57C2-927D-423c-AC11-F6D553E7F301}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B14787C-36BD-48fb-82B7-49572D27CFB3}.exeC:\Windows\{3B14787C-36BD-48fb-82B7-49572D27CFB3}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4569973-120D-482c-812C-649A23396CBC}.exeC:\Windows\{F4569973-120D-482c-812C-649A23396CBC}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA120BE0-DAEA-4dde-BCFE-5506DB146AFA}.exeC:\Windows\{FA120BE0-DAEA-4dde-BCFE-5506DB146AFA}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{948928CF-171E-4fe3-8DBC-28D2A981899B}.exeC:\Windows\{948928CF-171E-4fe3-8DBC-28D2A981899B}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AA8A147-AFA7-430f-8B20-1E3D14A0E8FE}.exeC:\Windows\{1AA8A147-AFA7-430f-8B20-1E3D14A0E8FE}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71CF3CC9-6F1B-41be-9A37-D8523D460680}.exeC:\Windows\{71CF3CC9-6F1B-41be-9A37-D8523D460680}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CA81675-6848-4c8a-A4B9-BFAB9FAD1AE7}.exeC:\Windows\{8CA81675-6848-4c8a-A4B9-BFAB9FAD1AE7}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{FA3D18C0-8F56-4169-B226-8F2DE3B633F4}.exeC:\Windows\{FA3D18C0-8F56-4169-B226-8F2DE3B633F4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{DDB11E09-7EDF-4598-A215-76FCC622298E}.exeC:\Windows\{DDB11E09-7EDF-4598-A215-76FCC622298E}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{CE8EE5D3-F815-4f2f-9266-7E6326B3F8FD}.exeC:\Windows\{CE8EE5D3-F815-4f2f-9266-7E6326B3F8FD}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDB11~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA3D1~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CA81~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71CF3~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AA8A~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94892~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA120~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4569~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B147~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{238A5~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\77D793~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5fb7e1e9e4777cb5d51911011111536f2
SHA107490de98224b815531b06a0d9720bf4b5f8155d
SHA25667bbf080ed3b4676ee4781146ca479077fbf1506a945f7b066b14175a847b4f9
SHA512fad555c401f43de9680f2b3ac62e30f2c6961c7f4f864e227039f7a136a784684f29d64451fa190a29bdd8344f2789d80a7a4c43709361f1898b41219b707070
-
Filesize
90KB
MD5c73984a4b49a2f6b9501a71f5f000737
SHA15398759047e2b185590f0b56a08aa7ae92ae53b6
SHA256fa39863c26aaf6a5e10afc791eee28b7db9b16daf3b2a23f8b0839efb7eb017d
SHA51215251ef50d70c909c239d28022e86bffbb2a7cea450b84c8f2f2a34dc2fc92db910caf65beb5e6f5b48c465d5becfcaf448d82e4b9a3cd9f076643de9cc53056
-
Filesize
90KB
MD538ff18c4d5c99e926f3d2268b9ae687a
SHA11c880d33a92c6db2ed06f713f4a41d554be673de
SHA256c9af596195e48c14ff4475598df66f152be9f9e158f07b1fe717208a684facde
SHA5126cfc95a74ba7db3f1eefb43b48d2afdaa8c15012f32e6e7ffdae2ab706a7c5471402c2d774cc5cd216f51543b4bb59082f7ef1a57049f42c43634324ce3198f3
-
Filesize
90KB
MD5cc2e91f91f8e37d7eac4855449853408
SHA148e3977d52355ca59b0643ce58b82fcf0933f097
SHA25668691cf90e50ab75d815b6d35e681279729ac0a0852a8ea0d453e2a722b12af4
SHA5127a66bfa9ad4131673c48b711ae98666c947b9bd7933f44212219af8c714f5b63d88eede7bdd51fbef208d7945406e295fbe1b51eb7ce65272683081840495891
-
Filesize
90KB
MD5d7ba7d5b1f7ec2b108654db5d689dda3
SHA102c396aee6b66063e400c1ca755b54530099c986
SHA256ba7589879c8f36d4c9fce1774eba14dd57dd7ea835fa7848c8332d85b26bc8d1
SHA512d16ca74d47f6fe462d34582ed49fddf1232a0130fb4517f9cebf9ace28309df8bd704af830063cf67457bc65ccba5d45e368a5f27fb96927d124c5b4db09aa4e
-
Filesize
90KB
MD5783b81dc965976fe72bb7ac28513a167
SHA155985ec942b521317b7f3377d611beaf63e1a114
SHA2561a0924aa50b95577053eb53149db63aeab27a86e203f766b39d3adfe28c18578
SHA512baa7097a6c18d4e2e975dd6ea1c0d58115cf1b74a04b78463f5765e6bfc4f054eba098772f5a69b35fdde1f5a8a750f28b90da00ed002bcd8ac874d942ba9475
-
Filesize
90KB
MD5bc7e2465a55102f7efa4953b6f471d36
SHA1853f75d7ae99693b48bd5acc4d71cd7bcad65d80
SHA256e29298801be29ab3a40ade429ad4da0a991a6e65fd62d34c2246defb185af632
SHA512d2cb21419bfb7679397cb6fd70222edcb1f32e7f63da714e6a0ad49928dd64c32a075c83d14636a99a979263d0bd3a8ca445c46a813f8402d882abecd6519cf6
-
Filesize
90KB
MD54a57ed3c96f3a9bcf60e77adacf6360a
SHA1bb2b824503e997722ecc831ef3c58ce9fd6dcff5
SHA2567e1e11315fc065bf6f3281de2f50d1db5dac75246790cd421cf709953b244f7e
SHA512c767ff3026e27793516da8bbe01f562b1291f9cff703d8ff052e5acfa1c1d93ec09b0e92e030e9132cc4d67752293d6da91a09151e88c8995bf89e523d1ff667
-
Filesize
90KB
MD594099a514f249d8b3b2b4dec1963ff77
SHA16bb248778f4605ae73631040b74c72a42910238f
SHA256cb4c5725d0dc2569478cc657f00ac1a6eab921a750105527885118e91a591e21
SHA512a84b622cd5eb21cf470c2b10d5d188d2a9fa3390104b6b83279e36ae78e91ce2ec6051172f2f90f9455a460054422159b0a57af6c724736a9439d8cc5eca7fe6
-
Filesize
90KB
MD52811cbee3f657d6d86d66f28ff2f1c93
SHA17dee9e81e38e43134d11330f463ec0106ef09f7a
SHA2567635e4bf7b87fd34f4eebb9c810d69f9034462b471f6b3d03635453371372862
SHA51271ec249f96f8d5359d6e5cb78b2b072ecf6267e6b9fedc768152109cb6c65ecccb2093362418274c25fd9cb0180d643c4c077e6548a3cb51e6092dc3874f76ef
-
Filesize
90KB
MD59a2fc8c3b95b41fda92b6a3f3e2f62ea
SHA1b4f17cb0494cff6aefd546481c5eaa2def271b8c
SHA256c05959cc7a1b138edfb9843573185b953d4a35f7bebcfeed6d8156aa8940f7d8
SHA5123189b6c566090c77977b935bb841d8e8a0430fb147661c333fd38e607f7b039f5d840c4b1ca495ca5258e647c6b8a7ce4ea2d83eb9472d80c7cb800ca359cb6b
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB