d40ba155e236f570cc23a11a9afa95ecbfdf1aa52b65c213dd8242f76ec0caef

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe
Size

48KB
MD5

6e41f8ddb4d7daff19eda6523e97beb0
SHA1

44b2a710579f7e55739f8be164fdecfd06e0ab21
SHA256

d40ba155e236f570cc23a11a9afa95ecbfdf1aa52b65c213dd8242f76ec0caef
SHA512

3cbaf3ac936bbbad1bbe8f1bad371a51d32bada01a8370b9f9928b77bf9caeb148fcba115edf1321629d79d24d69e34720d200d0d5d91dc594c24e8a070f7135
SSDEEP

768:l2EMQWlqBxRlHzZN2zJo3LeivGnCoPToFr1tptjFhaO:0lqBxRlHzZN2zSPvDoPTojtptjzz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2532	laccm.exe

Loads dropped DLL 2 IoCs

pid	Process
1996	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe
1996	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2532	1996	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe	28
PID 1996 wrote to memory of 2532	1996	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe	28
PID 1996 wrote to memory of 2532	1996	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe	28
PID 1996 wrote to memory of 2532	1996	6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e41f8ddb4d7daff19eda6523e97beb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\laccm.exe
  "C:\Users\Admin\AppData\Local\Temp\laccm.exe"
  2⤵
  - Executes dropped EXE
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\laccm.exe

Filesize
48KB

MD5
69d78bc22e08cd9318a565c07ea1275d

SHA1
9b2e76299335d644dcece1bdd7835055bfe3b47c

SHA256
e73988c012c9704c6b78e2eaaf178155a2ff650e96a48d43524371d7e2bfb9fa

SHA512
30269bff65b46476d5552bfc7e175cb94dae13c54fd9755e50c0997f4286afad6a1c4ed0831d7bada65198a67179c6f2b433d2b760b115c59986b24ddaf450d6

Download Submit
memory/1996-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2532-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download