41243aabea14bece3ac2b2ea58f0a11b470df35b74c94ba13b20c67fddd6a95c

Analysis

max time kernel
24s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe
Size 505KB
Sample240526-ega8daef99
SHA256 41243aabea14bece3ac2b2ea58f0a11b470df35b74c94ba13b20c67fddd6a95c
MD5 5f7efcb5bf8dd77f9522c4a517ab47c0
SHA1 dd6df96c904056bb8e3237476df8d66d763a29fa
SHA512 0f2abfe4973d9c4597e2d2abd228c47682276fb84833dc85938ad4415e95987f5e61be5385108cc566a56c44235520d1b4e7d01645e4dd69b93499d193bc37ef
SSDEEP 12288:wlb++b1gL5pRTcAkS/3hzN8qE43fm78VU:Wb++G5jcAkSYqyEU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3752	MSWDM.EXE
4528	MSWDM.EXE
4740	5F7EFCB5BF8DD77F9522C4A517AB47C0_NEIKIANALYTICS.EXE
1376	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev6021.tmp	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev6021.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	MSWDM.EXE
4528	MSWDM.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3752	672	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe	83
PID 672 wrote to memory of 3752	672	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe	83
PID 672 wrote to memory of 3752	672	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe	83
PID 672 wrote to memory of 4528	672	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe	84
PID 672 wrote to memory of 4528	672	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe	84
PID 672 wrote to memory of 4528	672	5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe	84
PID 4528 wrote to memory of 4740	4528	MSWDM.EXE	85
PID 4528 wrote to memory of 4740	4528	MSWDM.EXE	85
PID 4528 wrote to memory of 1376	4528	MSWDM.EXE	87
PID 4528 wrote to memory of 1376	4528	MSWDM.EXE	87
PID 4528 wrote to memory of 1376	4528	MSWDM.EXE	87

C:\Users\Admin\AppData\Local\Temp\5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:672
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3752
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev6021.tmp!C:\Users\Admin\AppData\Local\Temp\5f7efcb5bf8dd77f9522c4a517ab47c0_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Local\Temp\5F7EFCB5BF8DD77F9522C4A517AB47C0_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:4740
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev6021.tmp!C:\Users\Admin\AppData\Local\Temp\5F7EFCB5BF8DD77F9522C4A517AB47C0_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F7EFCB5BF8DD77F9522C4A517AB47C0_NEIKIANALYTICS.EXE

Path C:\Users\Admin\AppData\Local\Temp\5F7EFCB5BF8DD77F9522C4A517AB47C0_NEIKIANALYTICS.EXE
Size 505KB
SHA256 f60d8557f2d530bf3a14476133a1fdad59baa822f1011a20d8bc6e1a2021689e
MD5 4c4ffe72a32dbd5c9dbed3e66ee612b6
SHA1 51adb2a57b596072964572815ab460ebcbeb3951
SHA512 78c03f6cea70a5a3b98e7f96ffca16816123c3bb23bb6e07d81c9c24439d7f81c37762ca882e1b59400338722af7af8d755f5c4e2873d8ca4cc0aa42513c1f69
SSDEEP 12288:wlb++b1gL5pRTcAkS/3hzN8qE43fm78VR:Wb++G5jcAkSYqyER
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 47KB
SHA256 7707c6da44fe61ffd35227daebf83a8c01dcc5314d4913e75b32412f24a06729
MD5 6d7903728b74f798eb09c32e5ce442ac
SHA1 6b06f7968540eb77590a1be2b9c7de6211c0ec22
SHA512 9f4767fb95e8c7db8ab4675f2ecdd7d2165fa3461ff71afbde2782b87465c60a6b05803fdcb263aeb1f65a9db885046aee4dfe8b4f7bffdfe231bdd0496bd023
SSDEEP 768:HPNX6ls+G1H6HGg+siyj+dIni6psydADsOj33G2FsdqmPnuSOM58lT+sQI:Hlqls0GgUyj5JxdA4Oj3W2Fsdq4FvG+s
MD5 SHA1 SHA512 SSDEEP

Submit Download

dev6021.tmp

Path C:\Windows\dev6021.tmp
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/672-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/672-10-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1376-21-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3752-7-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3752-25-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4528-11-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4528-24-0x0000000000400000-0x000000000041B000-memory.dmp

Download