Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 18:11
Static task
static1
Behavioral task
behavioral1
Sample
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
-
Size
98KB
-
MD5
7bd23b2bafedcf6e8713e16363f92600
-
SHA1
22e039aee11fadb077562c0d8042f262c1524571
-
SHA256
4a0c1f036df7719f32f93aefae3bafe6074b70441e15963fafbbf8ab739be609
-
SHA512
43419fa101aa1d5f5c1893e9f5a5be8e0e06c809a2ec50c30663064c34fc070977fd4d90cae5b6263c3fdca337645bea4e3b4f078938d64c6826afaefa198062
-
SSDEEP
768:DAqvc8Ylh2G7zaaRzlKH6Z6zkEPvyV/UIuOoB7HKKnYH7i3xVYscGqMWBBVWP2m6:t6lhN7bHKafC0ImKxVnqFBmXFUzx
Malware Config
Extracted
metasploit
windows/download_exec
http://45.134.21.8:62/6iXe
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.execmd.exedescription pid process target process PID 2028 wrote to memory of 2380 2028 7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe cmd.exe PID 2028 wrote to memory of 2380 2028 7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe cmd.exe PID 2028 wrote to memory of 2380 2028 7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe cmd.exe PID 2028 wrote to memory of 2380 2028 7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe cmd.exe PID 2380 wrote to memory of 1264 2380 cmd.exe reg.exe PID 2380 wrote to memory of 1264 2380 cmd.exe reg.exe PID 2380 wrote to memory of 1264 2380 cmd.exe reg.exe PID 2380 wrote to memory of 1264 2380 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c set GBOxKoxZprki=7295 & reg add HKCU\SOFTWARE\zBWLazPouyCc /v yZxdMmHPRHarSfP /t REG_DWORD /d 15960 & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\zBWLazPouyCc /v yZxdMmHPRHarSfP /t REG_DWORD /d 159603⤵
- Modifies registry key