Analysis

  • max time kernel
    148s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 09:31

General

  • Target

    4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe

  • Size

    408KB

  • MD5

    4f4829ec2a13137c4129debdaf8d1bc0

  • SHA1

    609a82561759af4c322d5eeed3253830274fe9df

  • SHA256

    874146c65825150d843ef1bf43795c21a29e489a497c03ddcad24d4f2510fcf5

  • SHA512

    144f98f963ae9c2e21c2b24892b37d1920b749f7d6b7d917f44e1e7cb9394bc231a88d7a92d1950825158d646888c1c892302af10c99083169e00cafef8df985

  • SSDEEP

    6144:4jlYKRF/LReWAsUyY1eMgZ4si62vlbJ4xKoteZPpCpcXqsOyoE/WZZp:4jauDReWaYMttbJ4AoePic6l

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4f4829ec2a13137c4129debdaf8d1bc0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\ProgramData\uykes.exe
      "C:\ProgramData\uykes.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1828

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Documents and Settings .exe

          Filesize

          408KB

          MD5

          a608c447e38b17a72506e71f8add97ce

          SHA1

          e4ef8cbe0c34b420d7fb4fcc97efa1a7deec8921

          SHA256

          296c5b24fb2ffbc60ecbf881150caaeb02d665880dec83fd36901aca028a0c09

          SHA512

          700c823c0013eb78538a69fb5d8363615f1256e27163bf40b24ac5f20f652c08e852c0ddd51b39cf081162a749eabee34f5fa89fe558d4613ca5b29a83d56363

        • C:\ProgramData\Saaaalamm\Mira.h

          Filesize

          136KB

          MD5

          cb4c442a26bb46671c638c794bf535af

          SHA1

          8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

          SHA256

          f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

          SHA512

          074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

        • \ProgramData\uykes.exe

          Filesize

          271KB

          MD5

          78e6bfeac4dd51e653d1ef0af2807c75

          SHA1

          b61bad66adedb8d15d5368bc3aa7d226228f3687

          SHA256

          d072a1575367d3eaa219f17bc469faf8d40926b135bceaa1f43b3a15a2b8b34b

          SHA512

          90ae7e7e3a41f7ea8fca5b6a879211320eccee838e6e037935684c3c5e739f89639dbda5f8c9c2f241b76b3ac0e36bf4908dec298fa238615c57e6feefe354fc

        • memory/1700-0-0x0000000000400000-0x0000000000474000-memory.dmp

          Filesize

          464KB

        • memory/1700-1-0x0000000000400000-0x0000000000474000-memory.dmp

          Filesize

          464KB

        • memory/1700-14-0x0000000000400000-0x0000000000474000-memory.dmp

          Filesize

          464KB

        • memory/1828-133-0x0000000000400000-0x0000000000448000-memory.dmp

          Filesize

          288KB