ac4ae3f9fcb8f74d80e35c634ed5f74efb9bc101cd3b62558da543fd5d3dc444

Analysis

max time kernel
149s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
Size

408KB
MD5

a22eae2a8828fdc850373b54c8f99220
SHA1

475b1c625afd464a33f244f032bef748640a9e59
SHA256

ac4ae3f9fcb8f74d80e35c634ed5f74efb9bc101cd3b62558da543fd5d3dc444
SHA512

315129a37e8edcf5096e96c31c26305961c7d76f2ed461c196440d672e3e672c8ab3fd66c03c6db6ad2774802043aa83d1ec8e7a128675884ae15cc9d6c886ee
SSDEEP

6144:4jlYKRF/LReWAsUyeGLhjcALaJO100tUdiMjr6wx3Ugnk/Nn:4jauDReWUSGeEigE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rwcpbn.exe

pid process

2244 rwcpbn.exe

pid	process
2244	rwcpbn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rwcpbn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\rwcpbn.exe"	rwcpbn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe

description	pid	process	target process
PID 632 wrote to memory of 2244	632	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe	rwcpbn.exe
PID 632 wrote to memory of 2244	632	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe	rwcpbn.exe
PID 632 wrote to memory of 2244	632	a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe	rwcpbn.exe

C:\Users\Admin\AppData\Local\Temp\a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a22eae2a8828fdc850373b54c8f99220_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\ProgramData\rwcpbn.exe
"C:\ProgramData\rwcpbn.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe
Filesize
408KB

MD5
2efb545e90aa04fe0a0638ae2ed77fee

SHA1
96966bd8f753de217cf9e52f47277956b0ada512

SHA256
b5a7432fcc99c34b205bf4749abb5c12d4039f1042a66ae75a1fdf59bd6e83e6

SHA512
cbafc9fe4ff7b9494df1d1282f79b38e4bb24847fdd62ccbc1d39d64dffd9af65cdcc9721bb03c92ed4a601ddc1f110d7cd47fc0be59a3d725c4b52aa87a7121

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\rwcpbn.exe
Filesize
271KB

MD5
183a163c0bb2c370bd6000b11d3d6f22

SHA1
23173a6f92221ff4a9cb9bdf60332fa02732cc70

SHA256
c8a4436ebd559218ef0d0a96682085460a8d485c6115653e73050e34f9a796e6

SHA512
6eca3dd5ceb7b4188105c81691d8e76f41c4a5dfce623d9948511d009502b5740e4651f1a752608600d8a4184c189161a04c1369fff30353a0410a8f5b5b4d71

Download Submit
memory/632-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/632-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/632-9-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2244-130-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download