Analysis
-
max time kernel
28s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe
-
Size
139KB
-
MD5
3056a5017b3cd30eea84b9bea96ba560
-
SHA1
82c62917ef34a867dad11003657eef67e783e5f9
-
SHA256
80fe77e1b3c1f63ea767b6570cd004871fcd65888c9b20ef1cf2bb1dd8b2f962
-
SHA512
b3f6b60fb6cf8ad5989c0d0506d371cc23f4dcf6f021fb181aa602bd93e8584ce9899427c049c1b71d6c80c4b00aac3b6fdbd7b6127bfb1456154517c984e5fc
-
SSDEEP
3072:HQC/yj5JO3MnyG+Hu54Fx4xE8YLK4ddJMY86ipmns6P:wlj7cMnr+OEXjKCJMYN
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2780 MSWDM.EXE 1552 MSWDM.EXE 4560 3056A5017B3CD30EEA84B9BEA96BA560_NEIKIANALYTICS.EXE 4212 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe File opened for modification C:\Windows\dev446B.tmp 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe File opened for modification C:\Windows\dev446B.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1552 MSWDM.EXE 1552 MSWDM.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3092 wrote to memory of 2780 3092 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe 82 PID 3092 wrote to memory of 2780 3092 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe 82 PID 3092 wrote to memory of 2780 3092 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe 82 PID 3092 wrote to memory of 1552 3092 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe 83 PID 3092 wrote to memory of 1552 3092 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe 83 PID 3092 wrote to memory of 1552 3092 3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe 83 PID 1552 wrote to memory of 4560 1552 MSWDM.EXE 84 PID 1552 wrote to memory of 4560 1552 MSWDM.EXE 84 PID 1552 wrote to memory of 4212 1552 MSWDM.EXE 85 PID 1552 wrote to memory of 4212 1552 MSWDM.EXE 85 PID 1552 wrote to memory of 4212 1552 MSWDM.EXE 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2780
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev446B.tmp!C:\Users\Admin\AppData\Local\Temp\3056a5017b3cd30eea84b9bea96ba560_NeikiAnalytics.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3056A5017B3CD30EEA84B9BEA96BA560_NEIKIANALYTICS.EXE
- Executes dropped EXE
PID:4560
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev446B.tmp!C:\Users\Admin\AppData\Local\Temp\3056A5017B3CD30EEA84B9BEA96BA560_NEIKIANALYTICS.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4212
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD56f42c161aa7f78d303321b5f7e6fd078
SHA1458ed2296fb414ff90f7a84923ff50224c7e5106
SHA2561454134602485b3ff6ded813b07a27340d2b7e1eb6ef99f395dccaeab2059db9
SHA5123cf38b658937d6bbd4e4f618c06618f2414bf66b8fae0d520ab6df1aba5cb814d8a7e72c1a063d17acb3f4bc786b9c49b2315f2e88efe388a62d5bf71c1f5834
-
Filesize
80KB
MD550ac91f3b660f098e3e74d8a4adc17bf
SHA1ea3351008ef646fe6ad107aad472e325aa42681e
SHA256d2eae58d3a1896f4e65fcb8a45137a22230d871038c3eb6aefaa852ea251cd41
SHA51275822af757a1970d378a791428fec306130efb96a6750967ee2ea0f89e2dc484315264c11c988827906cea2bfbb78df1e201b40b19ec90e87d7a55579127003a
-
Filesize
59KB
MD5dfc18f7068913dde25742b856788d7ca
SHA1cbaa23f782c2ddcd7c9ff024fd0b096952a2b387
SHA256ff4ac75c02247000da084de006c214d3dd3583867bd3533ba788e22734c7a2bf
SHA512d0c7ec1dae41a803325b51c12490c355ed779d297daa35247889950491e52427810132f0829fc7ffa3022f1a106f4e4ba78ed612223395313a6f267e9ab24945