d0632bb3a3a86a4f9610a400d5f25372b5c07b327924f04386f5cfd1755804eb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe
Size

98KB
MD5

5fcaac7303670e6c80028f283a328e50
SHA1

fa08c22c30c732d3493d549f70284fc29578f274
SHA256

d0632bb3a3a86a4f9610a400d5f25372b5c07b327924f04386f5cfd1755804eb
SHA512

f30f5af28e17ed1bb0ce8d6ed258fd5d180a6ce5f0c320e5c6dc6fe6c4b67836576d04afeee0ee66e2374472d165a5677721a3985c416d6e9c34f939629601d7
SSDEEP

1536:NB+FC9RntfWeoGiPyCHjKDjfQQQtUetDTB2MtKN5:NB+F8tfPN4yCDKDjfQQQtm/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3068	budha.exe

Loads dropped DLL 2 IoCs

pid	Process
2252	5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe
2252	5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3068	2252	5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe	28
PID 2252 wrote to memory of 3068	2252	5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe	28
PID 2252 wrote to memory of 3068	2252	5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe	28
PID 2252 wrote to memory of 3068	2252	5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5fcaac7303670e6c80028f283a328e50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
98KB

MD5
47ecf3929533769d91affde88c463540

SHA1
05cd33b2abf078fd7a18bbe5d18bd77a3717ec7c

SHA256
8b52a53c7409792646e0437862d147a0d1a81f8b42aed2f0b435504db84c8707

SHA512
bdeb689dbaf27006dec5208b873b81f431ea22b1c431bfb0b4c21d53974b62508d386f9a294f8ddafa5b46a238cdc9376024e7f77a7e8c3b5efa478d17bc9547

Download Submit
memory/2252-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2252-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2252-2-0x0000000000409000-0x000000000040A000-memory.dmp

Filesize
4KB

Download
memory/2252-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2252-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3068-15-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3068-16-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3068-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download