Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:02
Static task
static1
Behavioral task
behavioral1
Sample
a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
-
Size
408KB
-
MD5
a22eae2a8828fdc850373b54c8f99220
-
SHA1
475b1c625afd464a33f244f032bef748640a9e59
-
SHA256
ac4ae3f9fcb8f74d80e35c634ed5f74efb9bc101cd3b62558da543fd5d3dc444
-
SHA512
315129a37e8edcf5096e96c31c26305961c7d76f2ed461c196440d672e3e672c8ab3fd66c03c6db6ad2774802043aa83d1ec8e7a128675884ae15cc9d6c886ee
-
SSDEEP
6144:4jlYKRF/LReWAsUyeGLhjcALaJO100tUdiMjr6wx3Ugnk/Nn:4jauDReWUSGeEigE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
tahay.exepid process 1992 tahay.exe -
Loads dropped DLL 2 IoCs
Processes:
a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exepid process 2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe 2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tahay.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\tahay.exe" tahay.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exedescription pid process target process PID 2080 wrote to memory of 1992 2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe tahay.exe PID 2080 wrote to memory of 1992 2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe tahay.exe PID 2080 wrote to memory of 1992 2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe tahay.exe PID 2080 wrote to memory of 1992 2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe tahay.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\tahay.exe"C:\ProgramData\tahay.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Documents and Settings .exeFilesize
408KB
MD51fa52350313475e56a2a0a74ec73ae60
SHA1baf66fea177396d99d05665ac7e1a9dab5072dda
SHA256f29618b514f54e9bc7daa0889c86e3e42c42514e68f4ed76e4f04a77d9be9bf3
SHA51227a14eaaa6f6116afdc37fe053322a29d889e8bc9b1096c50df78655356b3e69fdbc67eb68c76ee635966167105156cf5b6655488c9ba532882f73c842bfffbb
-
C:\ProgramData\Saaaalamm\Mira.hFilesize
136KB
MD5cb4c442a26bb46671c638c794bf535af
SHA18a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf
SHA256f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
SHA512074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3
-
\ProgramData\tahay.exeFilesize
271KB
MD5183a163c0bb2c370bd6000b11d3d6f22
SHA123173a6f92221ff4a9cb9bdf60332fa02732cc70
SHA256c8a4436ebd559218ef0d0a96682085460a8d485c6115653e73050e34f9a796e6
SHA5126eca3dd5ceb7b4188105c81691d8e76f41c4a5dfce623d9948511d009502b5740e4651f1a752608600d8a4184c189161a04c1369fff30353a0410a8f5b5b4d71
-
memory/1992-137-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2080-0-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2080-1-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2080-14-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB