c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 21:48

Target

b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe
Size

202KB
MD5

b9753e6a4e25385083221adf8dc6d5b0
SHA1

ba627129085d90cff569c40e65649155edc0572d
SHA256

c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d
SHA512

6ee9bcaf5eff303ebcf7d7992635bd5244cead4051ee42a87c5fd8dbdc67786c8c2434dc5ccc5536f4f01d51d416ed3cacc4d9487ce7cfaa6c1445a0b0a79bd2
SSDEEP

3072:114/IIhEDnmJL+ulN45BwNSoRZ7HYIh5PihD1Ypwh1shYeex+tvton02:1be4zwSoRZ7vSJOiAhY+tVonn

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

hybreieskm.exe

pid	Process
3456	hybreieskm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exehybreieskm.exe

description	pid	Process	procid_target
PID 932 wrote to memory of 3456	932	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe	82
PID 932 wrote to memory of 3456	932	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe	82
PID 932 wrote to memory of 3456	932	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe	82
PID 3456 wrote to memory of 2736	3456	hybreieskm.exe	86
PID 3456 wrote to memory of 2736	3456	hybreieskm.exe	86
PID 3456 wrote to memory of 2736	3456	hybreieskm.exe	86

C:\Users\Admin\AppData\Local\Temp\b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe
  C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe C:\Users\Admin\AppData\Local\Temp\lxeorr
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe
    C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe C:\Users\Admin\AppData\Local\Temp\lxeorr
    3⤵
    PID:2736

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\4508gpe9olqt7rpyqk

Filesize
170KB

MD5
2cba243abe4f15a1468c887af14f925c

SHA1
c42e155ac1a099da7d4ead3224b5163f43215eb2

SHA256
05b544eeab9c1ecb01eada8459f9d4c2d928832958e20ceef5c06327cdf4fa17

SHA512
e70258ade62f173c8b124e4aecf2d3b286bda069a593a7ce49f77856435fa02468e9a0ff2224d828df5073efae7ff638ca6a07657717b19ee9943e231ba65871

Download Submit
C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe

Filesize
5KB

MD5
3fe13edd25a0779eb87727b4ce3d7818

SHA1
16527b946c3694d83d3e7d8c452ad681a678208f

SHA256
fce6d2715739d7b855a83771d1c6a3e2822d625ca490b990a2908afba8df1dfe

SHA512
fd2b1a8cbd4bc408d3ca283389ba4a87c8421837f8edfe3b98e1bf9ca3a478369103f8cc57a8f8b3d364e637b30c3eafd423249b5ceb4f2e3cc13ca02db44cf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxeorr

Filesize
5KB

MD5
9a5a52d30c37e2f7afbb9781a418e1c4

SHA1
775d7a12959d6b01344e4d8484cfa7c058610df4

SHA256
e250b16974bcc0c304867b4b625d9718c4258653103678e08b4b14004266eb90

SHA512
fc1d0db987bbde4c97d4d5e90b557378230d3d35ac453535366076d04566aa3e45713c4e836270bab57f9f92a056eff354e51a721471ff79b3e2bc8ad8538bdf

Download Submit
memory/3456-8-0x0000000000B50000-0x0000000000B52000-memory.dmp

Filesize
8KB

Download