701059244663d78033536ce3125ccf28b507dd8b59408dfda4e4da115f93a571

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31df851875cd19743ec1ba3328200eb0_NeikiAnalytics.exe
Size

987KB
MD5

31df851875cd19743ec1ba3328200eb0
SHA1

9af93eade546292f55081b1c3e79ab18aaaefdac
SHA256

701059244663d78033536ce3125ccf28b507dd8b59408dfda4e4da115f93a571
SHA512

73a267851d67362cd562aa7e5f8178bc4303b00e0600a07d62c15bc382d619a914ae54d515220f6547d5324bb3f28f0486112720e45ded22e53f2353abf81e71
SSDEEP

12288:/1/aGLDCMNpNAkoSzZWD8ayXEMQCw7D0FoWxJpcEi0/3IWV//7cSdC/HpdbDG84k:/1/aGLDCM4D8ay0MZo8/iH/Ee

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
928	vrnlc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\vrnlc.exe"	vrnlc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 928	3284	31df851875cd19743ec1ba3328200eb0_NeikiAnalytics.exe	83
PID 3284 wrote to memory of 928	3284	31df851875cd19743ec1ba3328200eb0_NeikiAnalytics.exe	83
PID 3284 wrote to memory of 928	3284	31df851875cd19743ec1ba3328200eb0_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\31df851875cd19743ec1ba3328200eb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\31df851875cd19743ec1ba3328200eb0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\ProgramData\vrnlc.exe
  "C:\ProgramData\vrnlc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DDF.sys .exe

Filesize
987KB

MD5
26863c9f9f0c9e4e40890dd49780bae5

SHA1
7d9bb58bbdfd4617f57f2b7bbf9126730defefea

SHA256
f639522c0685f6a74d7626d97207bc3296d71d81e5368959386831377b012a8d

SHA512
121a36ecf047eb5cff2c9024bb0c20b50b9fe5af531dba0f9a01c4d171790fa27f59393bd6bcd7bc2364e40ace932552bb563ecdc622765c8adc20c08c3a49a1

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
477KB

MD5
0097732504850319971faed87f071fd4

SHA1
6f8bf40487719d18c54c85329ffc0346163e43db

SHA256
96e2cebea72e7205b4b0b53d67606ccbedd4e9eb34d852bed65bc89063541a48

SHA512
72af1a7e94544cb2b4a198713280823337a4cf4a7266320947a5b81ce4c41099c251ab86d94f753506328ad7750d3a0135d27af0ff5cf2147d01f3147d4448a7

Download Submit
C:\ProgramData\vrnlc.exe

Filesize
509KB

MD5
854cd524f496828b5432c43d338eff43

SHA1
ea88801084279a65fa85740c8791530246207923

SHA256
fce8d92da4a9ced338abe3ea09d2a23fda87b0caf9647870c662018ea81aa4fc

SHA512
534298a4d7fbdbe1de97edc5365d3a2c19e133d1f43c80cc1824f32a2f603a916440123e46e5ee6bd0e56d7f83f6cdf9a5a7c6c9af896e59ca5c97ee7f107f21

Download Submit
memory/928-132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3284-0-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/3284-9-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads