069fee5292a5eb7fc8d5711f9cfa0286f1658fef0b3a0910d38ed595d5394931

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 08:17

Target

b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe
Size

805KB
MD5

b0a9dc64767acc052449dd9e0d1e1e20
SHA1

5c3205ce4c4251013f1a4c4e2fe5639059ce6f77
SHA256

069fee5292a5eb7fc8d5711f9cfa0286f1658fef0b3a0910d38ed595d5394931
SHA512

a70947113d0cadb6539ec54db8e82a38ab8937470ed2a96794851947953913e175ff39acb74302c2bd1b60d658538394ecb330310ee52319f98973fe4670f4a4
SSDEEP

12288:WlGp0BiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:WXMatr0zAiX90z/F0jsFB3SQkJ

Score

7^/10

Executes dropped EXE 2 IoCs

Processes:

alg.exe

pid process

476
856 alg.exe

pid	process
476
856	alg.exe

Drops file in System32 directory 2 IoCs

Processes:

b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exealg.exe

description	ioc	process
File opened for modification	C:\Windows\System32\alg.exe	b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc8c6b4643e3c333.bin	alg.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1556 1212 WerFault.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe

description pid process

Token: SeTakeOwnershipPrivilege 1212 b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe

pid	pid_target	process	target process
1556	1212	WerFault.exe	b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1212	b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe

description	pid	process	target process
PID 1212 wrote to memory of 1556	1212	b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe	WerFault.exe
PID 1212 wrote to memory of 1556	1212	b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe	WerFault.exe
PID 1212 wrote to memory of 1556	1212	b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe	WerFault.exe
PID 1212 wrote to memory of 1556	1212	b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 212
  2⤵
  - Program crash
  PID:1556

\Windows\System32\alg.exe

Filesize
644KB

MD5
09bcce9d00d73159dd6b8f36cdda3eeb

SHA1
1b35997be2e7b1a25ee052f519a51c5cd7c70361

SHA256
fc31a9761a4544a468ee1ed0639a398fb5665e5e2699b0f56928c4b4bb370c0b

SHA512
6691839f08fb385236c21be3dcf485920a2bcb37c2201a427ab8127c96260f92ca26556754afa83cefa4c610da3fca977039f0b823dee8c2e45e6337829b214f

Download Submit
memory/856-12-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/856-13-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/856-19-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/856-20-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/856-24-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/1212-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1212-1-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/1212-6-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/1212-23-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download