a097652d753f0dba6d2028caab8e4f3a27fddadb4c9de7c00bb6bd3e0e647f27

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
Size 78KB
Sample240526-scdplabb47
SHA256 a097652d753f0dba6d2028caab8e4f3a27fddadb4c9de7c00bb6bd3e0e647f27
MD5 0b72c0411c42339fd35e38a617954f90
SHA1 63fb612b2ea4b1b4cf9861786ca82e0a99effdc3
SHA512 082d7c37729e8519faa6fae4ccb8cbbd030384000c6ed0ed87d3b6a5aa3772e612252cd98ffdfcf22a68ecde5be4b0bf592e0d4a9734322bc38479e850abdc7c
SSDEEP 1536:nPCHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt9/R17V:nPCHFo8dSE2EwR4uY41HyvYt9/F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2804	tmp944.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp944.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
Token: SeDebugPrivilege	2804	tmp944.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2188	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	28
PID 2820 wrote to memory of 2188	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	28
PID 2820 wrote to memory of 2188	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	28
PID 2820 wrote to memory of 2188	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	28
PID 2188 wrote to memory of 3016	2188	vbc.exe	30
PID 2188 wrote to memory of 3016	2188	vbc.exe	30
PID 2188 wrote to memory of 3016	2188	vbc.exe	30
PID 2188 wrote to memory of 3016	2188	vbc.exe	30
PID 2820 wrote to memory of 2804	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	31
PID 2820 wrote to memory of 2804	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	31
PID 2820 wrote to memory of 2804	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	31
PID 2820 wrote to memory of 2804	2820	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	31

C:\Users\Admin\AppData\Local\Temp\0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a64sh3d2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA4D.tmp"
    3⤵
    PID:3016
- C:\Users\Admin\AppData\Local\Temp\tmp944.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp944.tmp.exe" C:\Users\Admin\AppData\Local\Temp\0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA4E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA4E.tmp
Size 1KB
SHA256 933b22a324850419720c43113f46008984d1a74dd497df12d10ad22317c378dc
MD5 f585a58b0b7dbd1b58bc0abbc508db92
SHA1 fea9bfe4ec6cbfa00330b2d933c851a6ace7e433
SHA512 77a7c050de913fdf92a5045ba80f09aa15e8bd6616ac46bf192c6a61fe9abe5a7702014fadfb15f5e082568e0e94b0efedd40fe703e3b0e19b8ad9fde41f057e
MD5 SHA1 SHA512

Submit Download

a64sh3d2.0.vb

Path C:\Users\Admin\AppData\Local\Temp\a64sh3d2.0.vb
Size 15KB
SHA256 2733a0c8fdf86ecf86cba865a3a5afa78ef46d7c3e1fd16850445cb238fdaf16
MD5 529a6e0ce83a452cfbc0c704816f8a6e
SHA1 c0c0b4500360873b2e78bcdc673af159dcbd7587
SHA512 06ba5c299979d4dcd75aeff01d932e3707feeebdc2958ba8c6540542aae66e3d9e8edba5d5c5e802d71b75060b883844d9531060e8407b21d13f4899048bb4d2
SSDEEP 384:rWhifNAINUNhN5mJNNkNdcHbaE6NPzN7QXSN7eP:Sh+AwUb2EdcHCPh2+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

a64sh3d2.cmdline

Path C:\Users\Admin\AppData\Local\Temp\a64sh3d2.cmdline
Size 265B
SHA256 fdeb6b3168609686fe6e5893da19be35e774290433f93865727afd5b169ef172
MD5 4348f71fadd6a0100497cd395a08107d
SHA1 6636ac29cbb9e835bc61d98d8ac1fafa297f1cdb
SHA512 28f6cfa3b983be96a55612f7298a83aaa5ec8e893449ab974a13de9574857cb361c294f776c2da351584716e8b4b2b688acc9b0c064869dd5d1c8270328044b5
MD5 SHA1 SHA512

Submit Download

tmp944.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp944.tmp.exe
Size 78KB
SHA256 6589dc364dd222bc331eab6e64e02d05314b9b4dc43417aa4b2acc5d950ff2c1
MD5 a5336d483914302dc0c49c56a000a8e1
SHA1 7bfd2e2baba3df74cf486b7c888f9e007f3c01ce
SHA512 f69bb824fad0d82317408f6d6ac6d8e47c531a1c97b287e9dc97b9fa07054498443ab5c7eb9cc1506dba6ea2cb21f2d27edb6c921819f9fb0a1ebfb5d2726095
SSDEEP 1536:A4V51LT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt67S9/Z1ia:A4V5VE2EwR4uY41HyvYkS9/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcA4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbcA4D.tmp
Size 660B
SHA256 a16b28ab6324202cf5cf3d39cfba3a2ae8353c9d8b27055a73e9b0a83c784c64
MD5 b5885c3cc0b62052b01b94edaadc1efb
SHA1 7e05fe290a248b6ca5a60c04000f9a5bfc982326
SHA512 6d3213b643729a60ad109a77bfed10e8c443838670371b17e08ce67a7ba1580829eb4693dbeeb4d38b443458fb63b4c52a61225963360f9bfad0e60e2da9915e
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2188-8-0x0000000074F90000-0x000000007553B000-memory.dmp

Download

memory/2188-18-0x0000000074F90000-0x000000007553B000-memory.dmp

Download

memory/2820-0-0x0000000074F91000-0x0000000074F92000-memory.dmp

Download

memory/2820-1-0x0000000074F90000-0x000000007553B000-memory.dmp

Download

memory/2820-2-0x0000000074F90000-0x000000007553B000-memory.dmp

Download

memory/2820-24-0x0000000074F90000-0x000000007553B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads