Analysis
-
max time kernel
94s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 19:58
Behavioral task
behavioral1
Sample
7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe
-
Size
134KB
-
MD5
7246159f469ec0b7512de5b3e8f91810
-
SHA1
a7f09046ca198c2bc9179bdc13082af77bb5a3bc
-
SHA256
a83b57ba42fd83cca990f9ade703f47ec1cbe68f0c9ad5ba7795e465280c5863
-
SHA512
5a0e50fdcf1eaddb17fe07139b51447cdedb196f5cf0653ba4fa5cfdd064f1a81e797a19cc279b7707706b4ae9aecf2944ff723a4fff6ea4dffa1cbcb94b5a51
-
SSDEEP
1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QU:riAyLN9aa+9U2rW1ip6pr2At7NZuQU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 848 WwanSvc.exe -
resource yara_rule behavioral2/memory/1596-1-0x00000000000C0000-0x00000000000E8000-memory.dmp upx behavioral2/files/0x0007000000023493-4.dat upx behavioral2/memory/1596-5-0x00000000000C0000-0x00000000000E8000-memory.dmp upx behavioral2/memory/848-6-0x0000000000A30000-0x0000000000A58000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run" 7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1596 wrote to memory of 848 1596 7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe 81 PID 1596 wrote to memory of 848 1596 7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe 81 PID 1596 wrote to memory of 848 1596 7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7246159f469ec0b7512de5b3e8f91810_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\ProgramData\Update\WwanSvc.exe"C:\ProgramData\Update\WwanSvc.exe" /run2⤵
- Executes dropped EXE
PID:848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD56b0d4a71530ba1dfc819cc9906612edd
SHA16270bc87ebb6bfd67301ca61bfcfd223f14f49f8
SHA25614464d25cd265200c0a1ecd22272b852a6a80adacaccd1918e3432050da9d7b0
SHA51233e74a42f55160e09e9f4e6b68c6b722ba60371a693d49f6ecbd0407b33a3da169d380a318857bd0ac8e56d4de72dfceda79741b1bd15b249e987be5c0936d3a