Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe
-
Size
30KB
-
MD5
dcedfaac71341b86e1b4e974a5105f10
-
SHA1
4a67463f377d59b421656964bc0815721c83b234
-
SHA256
3fac860c4d0ad26814e8ec13db96454f734ed47b34a38c2d248584d270d6e406
-
SHA512
2e42584ad5ed768581aa8b43ebb9d95afd9b48b8adea3bab816041c3f82be39a1dfe8738c2f0fdd3b960fbfad26a11c58a8c662a3bc54ba94c237839cd3d3af0
-
SSDEEP
384:iTjB4f0y4lSqCHHffYZ5SKNOI5pbzCZYCKdKj+RYS9ON2tSUCu8FoE692yor:Q406H/0PbzCdj+Rh9OotSbxFTGtk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2324 budha.exe -
Loads dropped DLL 2 IoCs
pid Process 1684 dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe 1684 dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2324 1684 dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe 28 PID 1684 wrote to memory of 2324 1684 dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe 28 PID 1684 wrote to memory of 2324 1684 dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe 28 PID 1684 wrote to memory of 2324 1684 dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\budha.exe"C:\Users\Admin\AppData\Local\Temp\budha.exe"2⤵
- Executes dropped EXE
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5e6a93b6167735fb2e60fbd827df0279b
SHA1d887ebec9dac0e744c6fedb683caeee36d1545cc
SHA2567d07641528f81bdaa085d042be4fc5ab235da84ebd389b118d3b10957d552915
SHA5120efd850934c6dedfa96fccb312237677cb6349a3dc6e9cd30ade471b80b2460655d72e1bc6f33004ad5878f6c409b816da84da6f281a1403a4506e4dee7f865f