b3f8e23e6ebd819c5d43faff76017c7a42a85eedd52ee786df6fcd455fb9da64

General

Target

7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
Size

2.2MB
MD5

7f4a5c0d8aa97b76e79373b21082f4a0
SHA1

098d867e74bfeeff3678ec7866c66e4590238971
SHA256

b3f8e23e6ebd819c5d43faff76017c7a42a85eedd52ee786df6fcd455fb9da64
SHA512

b481c818633c65355b7b40c124eeafd387d4767fd8eae1dfb094bcbf11bb23337d70006d50aef5fc4fdb5d6d6d5dbd3dd755121f6f3f226df8512628bb1d7469
SSDEEP

24576:+0CbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344L:+0CbRquA/m2yL5zbfFiV+XenmE3/zU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2804	MSWDM.EXE
2928	MSWDM.EXE
2660	7F4A5C0D8AA97B76E79373B21082F4A0_NEIKIANALYTICS.EXE
2612	MSWDM.EXE

Loads dropped DLL 2 IoCs

pid	Process
2804	MSWDM.EXE
2696	Process not Found

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/files/0x000d000000013413-4.dat	upx
behavioral1/memory/2804-15-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2868-12-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2804-28-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2612-25-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2928-29-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev12C6.tmp	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2804	MSWDM.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2928	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	28
PID 2868 wrote to memory of 2928	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	28
PID 2868 wrote to memory of 2928	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	28
PID 2868 wrote to memory of 2928	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	28
PID 2868 wrote to memory of 2804	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 2804	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 2804	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 2804	2868	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	29
PID 2804 wrote to memory of 2660	2804	MSWDM.EXE	30
PID 2804 wrote to memory of 2660	2804	MSWDM.EXE	30
PID 2804 wrote to memory of 2660	2804	MSWDM.EXE	30
PID 2804 wrote to memory of 2660	2804	MSWDM.EXE	30
PID 2804 wrote to memory of 2612	2804	MSWDM.EXE	32
PID 2804 wrote to memory of 2612	2804	MSWDM.EXE	32
PID 2804 wrote to memory of 2612	2804	MSWDM.EXE	32
PID 2804 wrote to memory of 2612	2804	MSWDM.EXE	32

C:\Users\Admin\AppData\Local\Temp\7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2868
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2928
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev12C6.tmp!C:\Users\Admin\AppData\Local\Temp\7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\7F4A5C0D8AA97B76E79373B21082F4A0_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:2660
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev12C6.tmp!C:\Users\Admin\AppData\Local\Temp\7F4A5C0D8AA97B76E79373B21082F4A0_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MSWDM.EXE

Filesize
39KB

MD5
fcdbf839561963c0153432aafb2edd88

SHA1
d34b2c4fd725774f93d34ce411caee8a72c3cd46

SHA256
fd42fb02fe0e758cff209dabd8916a27cc9ae96632cb491eb0d484410a91f127

SHA512
f2e8e8257b26981cb6baf0d52d20f16ca5ed9649c4447da631a362261bbc933ab4255b9dbedc6e5852bf2c01bb5fd8d43d7b72d0457fb927713a1e35602d5c07

Download Submit
C:\Windows\dev12C6.tmp

Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit
memory/2612-25-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2804-15-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2804-28-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2868-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2868-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2928-29-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads