Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 11:39

General

  • Target

    58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    58b672f36e71251b2192f2e19baec830

  • SHA1

    25051d80782fa6cda0c17b43fe072622e7cbc8b9

  • SHA256

    3c621489d42f95481cd99461ba5d9d88eb6767f3fbdd0481001aaa81bd4ce196

  • SHA512

    83634cfdd3d5fed6a01e8bd05074b802cf5021c1ed50d8fb09e6ca968876c4cf7e6155ce8fed80010d5004df5f91dcace5e13d35b62d391a0d715fcc3f7fbcc2

  • SSDEEP

    1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOl:YfU/WF6QMauSuiWNi9eNOl0007NZIOl

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\ProgramData\Update\wuauclt.exe
      "C:\ProgramData\Update\wuauclt.exe" /run
      2⤵
      • Executes dropped EXE
      PID:2852
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe" >> NUL
      2⤵
      • Deletes itself
      PID:2724

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \ProgramData\Update\wuauclt.exe

          Filesize

          134KB

          MD5

          3e83afc4c793c0e7284cae4d2cecb15c

          SHA1

          a4195af9d36fee4457ebf13902fc0496713ff632

          SHA256

          88521442944a61003028ff638fb4ba395ef7017e863beb12fd70b0ee19ee2168

          SHA512

          e1570446e36dbe48f0ff3b4815817988e2646c629f305a28de352a0505478b2bc32527610a1d3a58edbf06f1b8b9874a379ccb3c2d24f321703b2ef2cc9261b9

        • memory/1688-0-0x00000000000E0000-0x0000000000108000-memory.dmp

          Filesize

          160KB

        • memory/1688-6-0x0000000000080000-0x00000000000A8000-memory.dmp

          Filesize

          160KB

        • memory/1688-8-0x00000000000E0000-0x0000000000108000-memory.dmp

          Filesize

          160KB

        • memory/1688-9-0x0000000000080000-0x00000000000A8000-memory.dmp

          Filesize

          160KB

        • memory/1688-11-0x00000000000E0000-0x0000000000108000-memory.dmp

          Filesize

          160KB

        • memory/2852-7-0x00000000012C0000-0x00000000012E8000-memory.dmp

          Filesize

          160KB

        • memory/2852-10-0x00000000012C0000-0x00000000012E8000-memory.dmp

          Filesize

          160KB