Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe
-
Size
408KB
-
MD5
4f4829ec2a13137c4129debdaf8d1bc0
-
SHA1
609a82561759af4c322d5eeed3253830274fe9df
-
SHA256
874146c65825150d843ef1bf43795c21a29e489a497c03ddcad24d4f2510fcf5
-
SHA512
144f98f963ae9c2e21c2b24892b37d1920b749f7d6b7d917f44e1e7cb9394bc231a88d7a92d1950825158d646888c1c892302af10c99083169e00cafef8df985
-
SSDEEP
6144:4jlYKRF/LReWAsUyY1eMgZ4si62vlbJ4xKoteZPpCpcXqsOyoE/WZZp:4jauDReWaYMttbJ4AoePic6l
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1828 uykes.exe -
Loads dropped DLL 2 IoCs
pid Process 1700 4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe 1700 4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\uykes.exe" uykes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1828 1700 4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe 28 PID 1700 wrote to memory of 1828 1700 4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe 28 PID 1700 wrote to memory of 1828 1700 4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe 28 PID 1700 wrote to memory of 1828 1700 4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\ProgramData\uykes.exe"C:\ProgramData\uykes.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5a608c447e38b17a72506e71f8add97ce
SHA1e4ef8cbe0c34b420d7fb4fcc97efa1a7deec8921
SHA256296c5b24fb2ffbc60ecbf881150caaeb02d665880dec83fd36901aca028a0c09
SHA512700c823c0013eb78538a69fb5d8363615f1256e27163bf40b24ac5f20f652c08e852c0ddd51b39cf081162a749eabee34f5fa89fe558d4613ca5b29a83d56363
-
Filesize
136KB
MD5cb4c442a26bb46671c638c794bf535af
SHA18a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf
SHA256f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
SHA512074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3
-
Filesize
271KB
MD578e6bfeac4dd51e653d1ef0af2807c75
SHA1b61bad66adedb8d15d5368bc3aa7d226228f3687
SHA256d072a1575367d3eaa219f17bc469faf8d40926b135bceaa1f43b3a15a2b8b34b
SHA51290ae7e7e3a41f7ea8fca5b6a879211320eccee838e6e037935684c3c5e739f89639dbda5f8c9c2f241b76b3ac0e36bf4908dec298fa238615c57e6feefe354fc