b3f8e23e6ebd819c5d43faff76017c7a42a85eedd52ee786df6fcd455fb9da64

General

Target

7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
Size

2.2MB
MD5

7f4a5c0d8aa97b76e79373b21082f4a0
SHA1

098d867e74bfeeff3678ec7866c66e4590238971
SHA256

b3f8e23e6ebd819c5d43faff76017c7a42a85eedd52ee786df6fcd455fb9da64
SHA512

b481c818633c65355b7b40c124eeafd387d4767fd8eae1dfb094bcbf11bb23337d70006d50aef5fc4fdb5d6d6d5dbd3dd755121f6f3f226df8512628bb1d7469
SSDEEP

24576:+0CbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344L:+0CbRquA/m2yL5zbfFiV+XenmE3/zU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3672	MSWDM.EXE
1896	MSWDM.EXE
3960	7F4A5C0D8AA97B76E79373B21082F4A0_NEIKIANALYTICS.EXE
540	MSWDM.EXE

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2552-1-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/files/0x000a0000000233d8-3.dat	upx
behavioral2/memory/2552-12-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/1896-10-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3672-6-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-18.dat	upx
behavioral2/memory/540-21-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/1896-24-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3672-25-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev4565.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev4565.tmp	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	MSWDM.EXE
1896	MSWDM.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3672	2552	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	84
PID 2552 wrote to memory of 3672	2552	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	84
PID 2552 wrote to memory of 3672	2552	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	84
PID 2552 wrote to memory of 1896	2552	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	85
PID 2552 wrote to memory of 1896	2552	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	85
PID 2552 wrote to memory of 1896	2552	7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe	85
PID 1896 wrote to memory of 3960	1896	MSWDM.EXE	86
PID 1896 wrote to memory of 3960	1896	MSWDM.EXE	86
PID 1896 wrote to memory of 540	1896	MSWDM.EXE	91
PID 1896 wrote to memory of 540	1896	MSWDM.EXE	91
PID 1896 wrote to memory of 540	1896	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2552
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3672
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4565.tmp!C:\Users\Admin\AppData\Local\Temp\7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\7F4A5C0D8AA97B76E79373B21082F4A0_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:3960
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4565.tmp!C:\Users\Admin\AppData\Local\Temp\7F4A5C0D8AA97B76E79373B21082F4A0_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7f4a5c0d8aa97b76e79373b21082f4a0_NeikiAnalytics.exe

Filesize
2.2MB

MD5
73fea272945ec3e6e551beb3229a44df

SHA1
84ea12a3fd9724d9e71da52f2d5505498a049298

SHA256
7ff4f65ad957e3f84b2e73c2e4bb3e0f83e120219f0bb805e2dc9ac4d1c8d304

SHA512
6934ceaab55cbfbdc0bd4942bd973f0c4a0171328a85089b0562c46ece7c9bc83996ebb34c5c0b0b19655f009d9ab098b91ccc114ec3d8083b175c76d1042ec2

Download Submit
C:\Windows\MSWDM.EXE

Filesize
39KB

MD5
fcdbf839561963c0153432aafb2edd88

SHA1
d34b2c4fd725774f93d34ce411caee8a72c3cd46

SHA256
fd42fb02fe0e758cff209dabd8916a27cc9ae96632cb491eb0d484410a91f127

SHA512
f2e8e8257b26981cb6baf0d52d20f16ca5ed9649c4447da631a362261bbc933ab4255b9dbedc6e5852bf2c01bb5fd8d43d7b72d0457fb927713a1e35602d5c07

Download Submit
C:\Windows\dev4565.tmp

Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit
memory/540-21-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1896-10-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1896-24-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2552-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2552-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3672-6-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3672-25-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads