ac4ae3f9fcb8f74d80e35c634ed5f74efb9bc101cd3b62558da543fd5d3dc444

Analysis

max time kernel
148s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
Size

408KB
MD5

a22eae2a8828fdc850373b54c8f99220
SHA1

475b1c625afd464a33f244f032bef748640a9e59
SHA256

ac4ae3f9fcb8f74d80e35c634ed5f74efb9bc101cd3b62558da543fd5d3dc444
SHA512

315129a37e8edcf5096e96c31c26305961c7d76f2ed461c196440d672e3e672c8ab3fd66c03c6db6ad2774802043aa83d1ec8e7a128675884ae15cc9d6c886ee
SSDEEP

6144:4jlYKRF/LReWAsUyeGLhjcALaJO100tUdiMjr6wx3Ugnk/Nn:4jauDReWUSGeEigE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

tahay.exe

pid process

1992 tahay.exe
Loads dropped DLL 2 IoCs

Processes:

a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe

pid process

2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
2080 a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe

pid	process
1992	tahay.exe

pid	process
2080	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
2080	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tahay.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\tahay.exe"	tahay.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe

description	pid	process	target process
PID 2080 wrote to memory of 1992	2080	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe	tahay.exe
PID 2080 wrote to memory of 1992	2080	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe	tahay.exe
PID 2080 wrote to memory of 1992	2080	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe	tahay.exe
PID 2080 wrote to memory of 1992	2080	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe	tahay.exe

C:\Users\Admin\AppData\Local\Temp\a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080

C:\ProgramData\tahay.exe
"C:\ProgramData\tahay.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1992

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe
Filesize
408KB

MD5
1fa52350313475e56a2a0a74ec73ae60

SHA1
baf66fea177396d99d05665ac7e1a9dab5072dda

SHA256
f29618b514f54e9bc7daa0889c86e3e42c42514e68f4ed76e4f04a77d9be9bf3

SHA512
27a14eaaa6f6116afdc37fe053322a29d889e8bc9b1096c50df78655356b3e69fdbc67eb68c76ee635966167105156cf5b6655488c9ba532882f73c842bfffbb

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
\ProgramData\tahay.exe
Filesize
271KB

MD5
183a163c0bb2c370bd6000b11d3d6f22

SHA1
23173a6f92221ff4a9cb9bdf60332fa02732cc70

SHA256
c8a4436ebd559218ef0d0a96682085460a8d485c6115653e73050e34f9a796e6

SHA512
6eca3dd5ceb7b4188105c81691d8e76f41c4a5dfce623d9948511d009502b5740e4651f1a752608600d8a4184c189161a04c1369fff30353a0410a8f5b5b4d71

Download Submit
memory/1992-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2080-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2080-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2080-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads