Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 18:11
Static task
static1
Behavioral task
behavioral1
Sample
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
-
Size
98KB
-
MD5
7bd23b2bafedcf6e8713e16363f92600
-
SHA1
22e039aee11fadb077562c0d8042f262c1524571
-
SHA256
4a0c1f036df7719f32f93aefae3bafe6074b70441e15963fafbbf8ab739be609
-
SHA512
43419fa101aa1d5f5c1893e9f5a5be8e0e06c809a2ec50c30663064c34fc070977fd4d90cae5b6263c3fdca337645bea4e3b4f078938d64c6826afaefa198062
-
SSDEEP
768:DAqvc8Ylh2G7zaaRzlKH6Z6zkEPvyV/UIuOoB7HKKnYH7i3xVYscGqMWBBVWP2m6:t6lhN7bHKafC0ImKxVnqFBmXFUzx
Malware Config
Extracted
metasploit
windows/download_exec
http://45.134.21.8:62/6iXe
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.execmd.exedescription pid process target process PID 768 wrote to memory of 1160 768 7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe cmd.exe PID 768 wrote to memory of 1160 768 7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe cmd.exe PID 768 wrote to memory of 1160 768 7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe cmd.exe PID 1160 wrote to memory of 3596 1160 cmd.exe reg.exe PID 1160 wrote to memory of 3596 1160 cmd.exe reg.exe PID 1160 wrote to memory of 3596 1160 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c set GBOxKoxZprki=7295 & reg add HKCU\SOFTWARE\zBWLazPouyCc /v yZxdMmHPRHarSfP /t REG_DWORD /d 15960 & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\zBWLazPouyCc /v yZxdMmHPRHarSfP /t REG_DWORD /d 159603⤵
- Modifies registry key