4945bda60968157caf76a0a972783928f17bc3391863d951f82e22c397fc4973

Analysis

max time kernel
28s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe
Size 527KB
Sample240529-mkswlabf2w
SHA256 4945bda60968157caf76a0a972783928f17bc3391863d951f82e22c397fc4973
MD5 51570ec35e7616d704ce0bb49897cbe0
SHA1 7f3c8cac9c62ac909910a60631cecce39604f062
SHA512 67ae8f4bfc8c4fb8c779f5e5cd1b23cdc32bb5cae897bca31d940bd3efeb6fbf33e2fd2b004a1b1d8233b7956269dcb2f461ef75b589daf78a42736727eaf1aa
SSDEEP 12288:wlbo+B5NaIk7nsp5pahQ2hkhsYvCpJZ2u4Tsgm/b:Wbo+B5lB2hkhfvCpf2fTfu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5000	MSWDM.EXE
3476	MSWDM.EXE
2376	51570EC35E7616D704CE0BB49897CBE0_NEIKIANALYTICS.EXE
796	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev3827.tmp	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev3827.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3476	MSWDM.EXE
3476	MSWDM.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 5000	4128	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe	82
PID 4128 wrote to memory of 5000	4128	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe	82
PID 4128 wrote to memory of 5000	4128	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe	82
PID 4128 wrote to memory of 3476	4128	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe	83
PID 4128 wrote to memory of 3476	4128	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe	83
PID 4128 wrote to memory of 3476	4128	51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe	83
PID 3476 wrote to memory of 2376	3476	MSWDM.EXE	84
PID 3476 wrote to memory of 2376	3476	MSWDM.EXE	84
PID 3476 wrote to memory of 2376	3476	MSWDM.EXE	84
PID 3476 wrote to memory of 796	3476	MSWDM.EXE	87
PID 3476 wrote to memory of 796	3476	MSWDM.EXE	87
PID 3476 wrote to memory of 796	3476	MSWDM.EXE	87

C:\Users\Admin\AppData\Local\Temp\51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4128
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5000
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev3827.tmp!C:\Users\Admin\AppData\Local\Temp\51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Users\Admin\AppData\Local\Temp\51570EC35E7616D704CE0BB49897CBE0_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:2376
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev3827.tmp!C:\Users\Admin\AppData\Local\Temp\51570EC35E7616D704CE0BB49897CBE0_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\51570ec35e7616d704ce0bb49897cbe0_NeikiAnalytics.exe
Size 527KB
SHA256 3925a83269dcc1f25a0d9238332c516e041682f2481f3c70ac0f305f439574bc
MD5 ca0327199d231543e89b6600653610a8
SHA1 90969ff09b608c0aa7dcf6736417497053b05f49
SHA512 d2632e7849a104f9e8d690235af315963451772e58de1fe4680432e7be3ae0daf0ece7add6da5f714395666d3237fcd16ab592d40ce1b65b0282d3fdba4249fb
SSDEEP 12288:wlbo+B5NaIk7nsp5pahQ2hkhsYvCpJZ2u4Tsgm/c:Wbo+B5lB2hkhfvCpf2fTf9
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 3c69a2458dc6d1a1d1022efae1146c5541c661eb7e161124eabea1bf4fc8c43b
MD5 d4f324176e864a4ba6c86ac00ec33851
SHA1 953a5de37833fae53d66912fa86d8adceb3dd74e
SHA512 703eec6157d0750d0684f091d14c229a640adc5266a9499a7e7d16963514198ca6ad495954495eac70b76f130a14461742e8149c4f43e7ddd43c9387b56ab399
SSDEEP 1536:Hlqls0GgUyj5JxdA4Oj3W2Fsdq4FmgG+sdguxnSngBNpT/mzNnxPAxEAz0+/u:HQC/yj5JO3MnmgG+Hu54Fx4xE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

dev3827.tmp

Path C:\Windows\dev3827.tmp
Size 447KB
SHA256 cd8e84c1f8d1ee3a7014343e3fb236329d2b67c1ec233ea4b208d99e3f95105b
MD5 3f461ca3e3d9da036cf1a4a06ddf4fb4
SHA1 15395e4b656cee3a708bc50c1094e3fa0c46802e
SHA512 d0cb3f56db648c9ee151990260a864cdcd0d508a1dafcd741d8b2ccd8f73ba29607f384a4e2752502419cfd4a41d2288d7c3ffec93925be85fc39dad9c01e7f5
SSDEEP 12288:75NaIk7nsp5pahQ2hkhsYvCpJZ2u4Tsgm/:75lB2hkhfvCpf2fTf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/796-20-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3476-11-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3476-24-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4128-8-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5000-10-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5000-25-0x0000000000400000-0x000000000041B000-memory.dmp

Download