5e2c2e6e156fb9b602c05954dd3cb6b778b5154d684fa549eb5dd6ea666af153

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe
Size

22KB
MD5

aeb75dc0b759e1a5f4cff9bff55ace50
SHA1

39156cbd227f99b2795fcbd45ab4d766a6917c1b
SHA256

5e2c2e6e156fb9b602c05954dd3cb6b778b5154d684fa549eb5dd6ea666af153
SHA512

bafb80caf25f55fe300eb94fcc1f66eac4bbf02bd27222cef3da4bf908d26cbf3bb2da8846bb25802dbcb4d9a33ef67f271a62c7f87dae6727517413f5acc115
SSDEEP

192:qytgAeuB2S7FFWlSkABcI+EWL/hTUozHLYDo2SIcIn8/wKUlT8AF8rV3u:qySFpcI5pTUo7L2FSmnmwKUl4AF8rY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2960	cchip.exe

Loads dropped DLL 1 IoCs

pid	Process
2172	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2960	2172	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2960	2172	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2960	2172	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2960	2172	aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\cchip.exe
  "C:\Users\Admin\AppData\Local\Temp\cchip.exe"
  2⤵
  - Executes dropped EXE
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cchip.exe

Filesize
22KB

MD5
2d57db14290f333596aead06582d1d1f

SHA1
4a5d4f9f47a2f4b3023507f87106ef3e549d1ced

SHA256
393cd1aaeb77c689757b1390682076aba5911544bc726a0e4860ddd21e778efe

SHA512
7e50767afa74cf054cc26a862962905507ac078d05db9682fe0ea76ce4dbee6024f9122c8989a85cd31f812509ac062fb35c1940e79438505f0756234f68004f

Download Submit
memory/2172-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2960-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download