070d3586b075455363d7c3c46e4baa9301b5344054cae3226b6ad771fdbb5b72

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe
Size

69KB
MD5

5fbf1bb6852b7e148d7634c6350e1f50
SHA1

f74779569a8e12ce05ad09ab2f5200c27aa3db13
SHA256

070d3586b075455363d7c3c46e4baa9301b5344054cae3226b6ad771fdbb5b72
SHA512

d0d8ce9a36ef4d8f55116ce6aab8ae84762ea8ceda41c060ca67497e671177f3efe50fcb4917b808a8025281b7a1d0ab1baf36433681657207fcff238caf8ea2
SSDEEP

1536:NB+FC9RntfWeoGiPyCHjKDjfQQQtUe/g7L0D:NB+F8tfPN4yCDKDjfQQQtHD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2864	budha.exe

Loads dropped DLL 2 IoCs

pid	Process
2856	5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe
2856	5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2864	2856	5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe	28
PID 2856 wrote to memory of 2864	2856	5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe	28
PID 2856 wrote to memory of 2864	2856	5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe	28
PID 2856 wrote to memory of 2864	2856	5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5fbf1bb6852b7e148d7634c6350e1f50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD070.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
69KB

MD5
6dedb17dd1ee384275e51e0e5228f1f4

SHA1
0383de6ce1f4666940034272458ec084992faf54

SHA256
91195cd9b527d08d3a80580f572b08816b656ffedcc4b4664027c432689978b6

SHA512
0132504630f7d4b17b79165cf91311336295cb3f19bed3637f528048c9603d584d04933c747c5cacf8c133d9fdf5aaaed2b1a1f8bbbc8d6d9327f48308a646d6

Download Submit
memory/2856-13-0x0000000002F90000-0x0000000002FAC000-memory.dmp

Filesize
112KB

Download
memory/2856-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2856-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2856-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2856-15-0x0000000002F90000-0x0000000002FAC000-memory.dmp

Filesize
112KB

Download
memory/2856-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2856-2-0x0000000000409000-0x000000000040A000-memory.dmp

Filesize
4KB

Download
memory/2864-17-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2864-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2864-20-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2864-19-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2864-22-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download