6c9a042cdc856fee24d77d9d9482f37b8a8357362f20b5acb20018de8bc16812

General

Target

10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
Size

538KB
MD5

10e2dcfcefa8cbd09ec9350ae20d35a0
SHA1

2c86134b84c46559dbaa490be0b305b888029bf7
SHA256

6c9a042cdc856fee24d77d9d9482f37b8a8357362f20b5acb20018de8bc16812
SHA512

862adfa3f456aa72d4621f489ec388e0c09fef4515a0c68a8546f1c69f10e85f41112815e012857ef86cb9ba30102c180efe20e79f5351d7303acc2a6f631eed
SSDEEP

12288:wlbU+41gL5pRTcAkS/3hzN8qE43fm78Vy:WbU+N5jcAkSYqyEy

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3636	MSWDM.EXE
3552	MSWDM.EXE
1856	10E2DCFCEFA8CBD09EC9350AE20D35A0_NEIKIANALYTICS.EXE
1112	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev4035.tmp	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev4035.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3552	MSWDM.EXE
3552	MSWDM.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3636	3188	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe	83
PID 3188 wrote to memory of 3636	3188	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe	83
PID 3188 wrote to memory of 3636	3188	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe	83
PID 3188 wrote to memory of 3552	3188	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe	84
PID 3188 wrote to memory of 3552	3188	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe	84
PID 3188 wrote to memory of 3552	3188	10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe	84
PID 3552 wrote to memory of 1856	3552	MSWDM.EXE	85
PID 3552 wrote to memory of 1856	3552	MSWDM.EXE	85
PID 3552 wrote to memory of 1112	3552	MSWDM.EXE	87
PID 3552 wrote to memory of 1112	3552	MSWDM.EXE	87
PID 3552 wrote to memory of 1112	3552	MSWDM.EXE	87

C:\Users\Admin\AppData\Local\Temp\10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3188
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3636
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4035.tmp!C:\Users\Admin\AppData\Local\Temp\10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Users\Admin\AppData\Local\Temp\10E2DCFCEFA8CBD09EC9350AE20D35A0_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:1856
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4035.tmp!C:\Users\Admin\AppData\Local\Temp\10E2DCFCEFA8CBD09EC9350AE20D35A0_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\10e2dcfcefa8cbd09ec9350ae20d35a0_NeikiAnalytics.exe

Filesize
538KB

MD5
5f6bb8e0cde49caae08e16de89bbc163

SHA1
51c7895307ab83816ef4e157db8275843d665ef2

SHA256
32a0ea282bee2cc724900be79c64c793358b561192c3ff3a137fca3d9e06b053

SHA512
379424b82a8a0e2554fa221e8760fcb7a26062a0294f316dca040e8b56ee092bd7ce535900cd31e0a721bef1efbc81080d0c7f503236179b765e9e4f0fbc634b

Download Submit
C:\Windows\MSWDM.EXE

Filesize
80KB

MD5
fcc0028ce46b10d2e5baf522651bbc00

SHA1
65bf0b7669b24a385358d936ac46ba7d903e64c6

SHA256
e6c049e1f492aed202dddc09eb5e7a0b0b1693070fe36698cdc2641180d4f354

SHA512
c06a675c9cfa366645b5dae8625182a015ea639077cdcd394c7ecbf8704f92154d72abc2cd0a242cd57093ee75664e4588fc3c6a214ba06b5a511973a58b63f3

Download Submit
C:\Windows\dev4035.tmp

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
memory/1112-21-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3188-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3188-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3552-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3552-24-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3636-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3636-25-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads