Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
27-05-2024 17:55
General
-
Target
06b8bc69117c1776c98b14da0a894650_NeikiAnalytics.exe
-
Size
135KB
-
MD5
06b8bc69117c1776c98b14da0a894650
-
SHA1
fbeb617381d41f63f0b78b09d2b77de9350bc5c1
-
SHA256
b1fc0e3b5fe6484985b78cd93d7424c375f5e210760182c6c0971b7cb763bc8b
-
SHA512
d77162217f93b88ed3e3517b7367a17740ef021038cd93adfdec2bf55c7972dfa7f154170609fe73be7bf156c61042eb1ea95e7a816ff40cec3b47a1463e66b3
-
SSDEEP
1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgtWd:XVqoCl/YgjxEufVU0TbTyDDalbd
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06b8bc69117c1776c98b14da0a894650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06b8bc69117c1776c98b14da0a894650_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5fdbc1f9c24c95079b568bdd5f28578b6
SHA1102a893fedb36712eb8690387222629115774b84
SHA256b135e17aa55ce4cb8c4813afef69230a2429c0389f0a016dd2a68f0ca7ae6092
SHA512bf190c1bcd5df59572c3ec51ad8279df81fecefa31d1eeffae2904bf65a9fb320424ae0b8aab15820242ff98fbc06a2ec92d2b09b6043b0e38d9a795d564def6
-
Filesize
135KB
MD5f06f510a98bdc29910a0236e4ffd81c1
SHA1a2b5edaeb4b334ca22d5a6aa923eab6b148e63fd
SHA2567a623253bfc2e0ce2d39e37386aa68804e8ad1a0b96e43af592f7fa3b4715c9f
SHA512c97d32f3ed0494f51a21d726877563a9926d9c89453429d3e3cc08cd88023fd0d89ec30de5dd0f63591ed5c886ceb592ead9a6c5baa1f39baeccc92d563bc28a
-
Filesize
135KB
MD562e6d6d9023e2b1389e67df5c2b654a5
SHA18e5b8bbb2501eedf4476a4c8b726fe46d454786a
SHA256d4a54f328647e050517bb4c9488225c8a6becbca1a3191351732491b3c343d20
SHA512d319ddd4423269831c226fa1ca33276e3f1faaf1531876a9fd97d40d928e3eb1b8fbe022c96d77846a714cde97f7fb8cd52979ef37eedc4fb8df817469d8b919
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB