124e2f5a8055b6bbd8066b83b7270f3ef93efacea7a2d9130522a2164e942ed3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e0aa12eb15ee73fc31652d21e4310a0_NeikiAnalytics.exe
Size

1.5MB
MD5

9e0aa12eb15ee73fc31652d21e4310a0
SHA1

982df094944a996f6ee2b347e4dd34502b227c8d
SHA256

124e2f5a8055b6bbd8066b83b7270f3ef93efacea7a2d9130522a2164e942ed3
SHA512

ef60737e3db096f7ca02f4aeedad1728d8c7464606e4473f7ac4551c29d7b2c91000e8a1343569cd1b4e00ca55a58a51272f5a8c5744a20edda7bc70a8ff74a1
SSDEEP

12288:Up/SInr8vv2BDeT+bVYHTb3FRk/rMNxaXqqlPbJKTGv5DYFXOBnXREHa:K/i328ab4F+rM/aXq6bJfBUam6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
480	Process not Found
2544	alg.exe
2616	aspnet_state.exe

Loads dropped DLL 1 IoCs

pid	Process
480	Process not Found

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	9e0aa12eb15ee73fc31652d21e4310a0_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	9e0aa12eb15ee73fc31652d21e4310a0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1720	9e0aa12eb15ee73fc31652d21e4310a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9e0aa12eb15ee73fc31652d21e4310a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9e0aa12eb15ee73fc31652d21e4310a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.5MB

MD5
e5a8fa9a8030adef96e02b5b63802555

SHA1
a5c30010dbb550342b0b2a3eb97ef0a16dcb8a73

SHA256
78d7d51ffecf4eb58dc1107a6486f7c2db64a95abaea37d9272e382671ffc940

SHA512
ae0e2fd1df8b48d067c8c5ba5941b92e34acf5e3b4b2bc6b53b29eea33995fe2c137f10a83f3f7681cac7e96b0c3bf7e84859bcee10d7af1faaac46888e2d19d

Download Submit
\Windows\System32\alg.exe

Filesize
1.6MB

MD5
3762536f57093eda14c06ea760960e9b

SHA1
70e6844c033e4ba03d06bf4e42037b50708af131

SHA256
83f82434ca45a7802b0c603ca0b22fac1693a09b329add5d7226de600a6bce68

SHA512
a44354034ec5c668acefa505356c8afe6c7924fd94152a1816eff8212fbd14b248242cb0484a2f4c7354c857ff7b6f814dafbbf381d0dad0f2c9a99df76eb279

Download Submit
memory/1720-0-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/1720-1-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/1720-6-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/1720-18-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/2544-12-0x0000000100000000-0x0000000100198000-memory.dmp

Filesize
1.6MB

Download
memory/2544-20-0x0000000100000000-0x0000000100198000-memory.dmp

Filesize
1.6MB

Download
memory/2616-19-0x0000000140000000-0x0000000140191000-memory.dmp

Filesize
1.6MB

Download
memory/2616-21-0x0000000140000000-0x0000000140191000-memory.dmp

Filesize
1.6MB

Download