722aed418ba8a57de1d9cdb8b2c5bdffba25abbc0543e7b6d6240aa847173164

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe
Size

395KB
MD5

ab0a8237c698735b5789cd93f33208d0
SHA1

da5de8698bd7bc194228cdfbccaf2354f21de5a5
SHA256

722aed418ba8a57de1d9cdb8b2c5bdffba25abbc0543e7b6d6240aa847173164
SHA512

747b3ed107ccbf06c9bb1888e1c5ab6827ea312457ec8cc9e4abde57930747f53e6796eef5b1069e84bf84c93782d4aad16a6a8ba6920f94630aac9f9e21d2f8
SSDEEP

6144:4jlYKRF/LReWAsUylPXAxi5mwN4mCkhPh/h4Gqo+WDheLA:4jauDReWr0i5mwN4mCkhPhMEwLA

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	hklgn.exe

Loads dropped DLL 2 IoCs

pid	Process
2172	ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe
2172	ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\hklgn.exe"	hklgn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2780	2172	ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2780	2172	ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2780	2172	ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2780	2172	ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ab0a8237c698735b5789cd93f33208d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172
- C:\ProgramData\hklgn.exe
  "C:\ProgramData\hklgn.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
395KB

MD5
322a8912c68ab6cc4e4b7c77b2a29057

SHA1
6b26af0d62990d914c6b643a0b19a7b4fe2481ad

SHA256
b8047ef31594ebdaf42c4e68ca7d3ee73e34668148ec59736f866ce288868f73

SHA512
8b53bd4ef5f35aac4c0706ca59240c412c3c5bad54880f442b4fbf99822525d6e4543e3b72fad54cd98a4f5569b9e8b3ca93c9b348347c73b4fa8d243d1fadbd

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
\ProgramData\hklgn.exe

Filesize
258KB

MD5
865be63c87dba6df137ee7fa6b3d1142

SHA1
cf7aa4805311e19b59505e85e9bfc7ed335fb26c

SHA256
55f1ed73b6dd5b67793bcbf5a7a0f57c78afa69239d0b426f6b962b155325c22

SHA512
a77bdad14328c51af7730a97ade78189b1f000ec8d06a4042cfe0b497903c3ee59006b285d81b25b491fb3cf049821215f86fdfcbba328d5d97ff344a6edc628

Download Submit
memory/2172-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2172-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2172-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2780-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads