b010909ad483e1a1325afe3f5342f34bd0a03e52e7854e7c3f75ccef34f0fc71

General

Target

0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe
Size

505KB
MD5

0946ed7a88165f5a0be5ce433dcc9680
SHA1

7250e69ab0cce58e2419846c33d66aa3fbc51bf8
SHA256

b010909ad483e1a1325afe3f5342f34bd0a03e52e7854e7c3f75ccef34f0fc71
SHA512

5c42aca4fe2cd999935f2c5d35608f9e60393cc70f9c13441ad3793cabe560016fb82159f31c2b2f32860ddd1e4a77d78310bd414d8531825f6a9455b286367a
SSDEEP

12288:wlbi+b1gL5pRTcAkS/3hzN8qE43fm78VG:Wbi+G5jcAkSYqyEG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3040	MSWDM.EXE
2092	MSWDM.EXE
2744	0946ED7A88165F5A0BE5CE433DCC9680_NEIKIANALYTICS.EXE
2600	MSWDM.EXE

Loads dropped DLL 2 IoCs

pid	Process
3040	MSWDM.EXE
2876	Process not Found

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev18BE.tmp	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev18BE.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	MSWDM.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2092	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	28
PID 1936 wrote to memory of 2092	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	28
PID 1936 wrote to memory of 2092	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	28
PID 1936 wrote to memory of 2092	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	28
PID 1936 wrote to memory of 3040	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 3040	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 3040	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 3040	1936	0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe	29
PID 3040 wrote to memory of 2744	3040	MSWDM.EXE	30
PID 3040 wrote to memory of 2744	3040	MSWDM.EXE	30
PID 3040 wrote to memory of 2744	3040	MSWDM.EXE	30
PID 3040 wrote to memory of 2744	3040	MSWDM.EXE	30
PID 3040 wrote to memory of 2600	3040	MSWDM.EXE	32
PID 3040 wrote to memory of 2600	3040	MSWDM.EXE	32
PID 3040 wrote to memory of 2600	3040	MSWDM.EXE	32
PID 3040 wrote to memory of 2600	3040	MSWDM.EXE	32

C:\Users\Admin\AppData\Local\Temp\0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1936
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2092
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev18BE.tmp!C:\Users\Admin\AppData\Local\Temp\0946ed7a88165f5a0be5ce433dcc9680_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\0946ED7A88165F5A0BE5CE433DCC9680_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:2744
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev18BE.tmp!C:\Users\Admin\AppData\Local\Temp\0946ED7A88165F5A0BE5CE433DCC9680_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0946ED7A88165F5A0BE5CE433DCC9680_NEIKIANALYTICS.EXE

Filesize
505KB

MD5
5a473b86842f70103af7241cfced3da6

SHA1
73782747f4d149aac30d26ae731dd293899fad9f

SHA256
efbed6923f22af982726a90d4d8778ed049c249cd23568c38d815b6e92109d0d

SHA512
5e6c90113a1e2439862d95b139b96a90c00f33991be4ee983c41d62f37dc7bc1c13b2ad6a38e3ca10d8be95e53261c671847f7aaede38aa6b981eac1038402e9

Download Submit
C:\Windows\MSWDM.EXE

Filesize
47KB

MD5
17b789e1d1c2ac8883a68e3fdf6e06b1

SHA1
f04386e2facad18e7412954d63079ea4a794457b

SHA256
a1bc39e4bbc1a47b5678b2eefe3611bc61dfcb2b93025f8352123cce55a3bd69

SHA512
01cb25a97e31da8947669536251215c1df9b8001d774269b17b68244a5516a452e8e540d0c6ea13d58d5fe8833fa7be7007a75d51659bbdb41dc7f3c90141f81

Download Submit
C:\Windows\dev18BE.tmp

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
memory/1936-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2092-21-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2092-34-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2600-30-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3040-20-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3040-33-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3040-24-0x0000000000250000-0x000000000026B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads