Analysis
-
max time kernel
20s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 15:58
Static task
static1
Behavioral task
behavioral1
Sample
10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
-
Size
538KB
-
MD5
10e2dcfcefa8cbd09ec9350ae20d35a0
-
SHA1
2c86134b84c46559dbaa490be0b305b888029bf7
-
SHA256
6c9a042cdc856fee24d77d9d9482f37b8a8357362f20b5acb20018de8bc16812
-
SHA512
862adfa3f456aa72d4621f489ec388e0c09fef4515a0c68a8546f1c69f10e85f41112815e012857ef86cb9ba30102c180efe20e79f5351d7303acc2a6f631eed
-
SSDEEP
12288:wlbU+41gL5pRTcAkS/3hzN8qE43fm78Vy:WbU+N5jcAkSYqyEy
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2876 MSWDM.EXE 2532 MSWDM.EXE 2516 10E2DCFCEFA8CBD09EC9350AE20D35A0_NEIKIANALYTICS.EXE 2424 MSWDM.EXE -
Loads dropped DLL 2 IoCs
pid Process 2532 MSWDM.EXE 2504 Process not Found -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\dev898.tmp 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe File created C:\WINDOWS\MSWDM.EXE 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2532 MSWDM.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2876 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 2876 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 2876 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 2876 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 2532 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 29 PID 2880 wrote to memory of 2532 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 29 PID 2880 wrote to memory of 2532 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 29 PID 2880 wrote to memory of 2532 2880 10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe 29 PID 2532 wrote to memory of 2516 2532 MSWDM.EXE 30 PID 2532 wrote to memory of 2516 2532 MSWDM.EXE 30 PID 2532 wrote to memory of 2516 2532 MSWDM.EXE 30 PID 2532 wrote to memory of 2516 2532 MSWDM.EXE 30 PID 2532 wrote to memory of 2424 2532 MSWDM.EXE 32 PID 2532 wrote to memory of 2424 2532 MSWDM.EXE 32 PID 2532 wrote to memory of 2424 2532 MSWDM.EXE 32 PID 2532 wrote to memory of 2424 2532 MSWDM.EXE 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2876
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev898.tmp!C:\Users\Admin\AppData\Local\Temp\10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe! !2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\10E2DCFCEFA8CBD09EC9350AE20D35A0_NEIKIANALYTICS.EXE
- Executes dropped EXE
PID:2516
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev898.tmp!C:\Users\Admin\AppData\Local\Temp\10E2DCFCEFA8CBD09EC9350AE20D35A0_NEIKIANALYTICS.EXE!3⤵
- Executes dropped EXE
PID:2424
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5fcc0028ce46b10d2e5baf522651bbc00
SHA165bf0b7669b24a385358d936ac46ba7d903e64c6
SHA256e6c049e1f492aed202dddc09eb5e7a0b0b1693070fe36698cdc2641180d4f354
SHA512c06a675c9cfa366645b5dae8625182a015ea639077cdcd394c7ecbf8704f92154d72abc2cd0a242cd57093ee75664e4588fc3c6a214ba06b5a511973a58b63f3
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628