Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 12:21

General

  • Target

    dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe

  • Size

    30KB

  • MD5

    dcedfaac71341b86e1b4e974a5105f10

  • SHA1

    4a67463f377d59b421656964bc0815721c83b234

  • SHA256

    3fac860c4d0ad26814e8ec13db96454f734ed47b34a38c2d248584d270d6e406

  • SHA512

    2e42584ad5ed768581aa8b43ebb9d95afd9b48b8adea3bab816041c3f82be39a1dfe8738c2f0fdd3b960fbfad26a11c58a8c662a3bc54ba94c237839cd3d3af0

  • SSDEEP

    384:iTjB4f0y4lSqCHHffYZ5SKNOI5pbzCZYCKdKj+RYS9ON2tSUCu8FoE692yor:Q406H/0PbzCdj+Rh9OotSbxFTGtk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\dcedfaac71341b86e1b4e974a5105f10_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      PID:2324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    30KB

    MD5

    e6a93b6167735fb2e60fbd827df0279b

    SHA1

    d887ebec9dac0e744c6fedb683caeee36d1545cc

    SHA256

    7d07641528f81bdaa085d042be4fc5ab235da84ebd389b118d3b10957d552915

    SHA512

    0efd850934c6dedfa96fccb312237677cb6349a3dc6e9cd30ade471b80b2460655d72e1bc6f33004ad5878f6c409b816da84da6f281a1403a4506e4dee7f865f