4f553429bdd34e794295e110e6cb6da3741e75d6d4022831812f3a5797527c09

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe
Size

134KB
MD5

9230a7115cc5c55ebfa095e62fd7a290
SHA1

e2287bc6f342e51c70c09e0c8bc0e01e30e2c55d
SHA256

4f553429bdd34e794295e110e6cb6da3741e75d6d4022831812f3a5797527c09
SHA512

a425972545e0328258e1e8e4e257559520946de1caaa8c24fc63b826f354d7625f2dd3ec594f50a271b2da651d80576a9cad51adcc390896ab91c937477458cf
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qc:riAyLN9aa+9U2rW1ip6pr2At7NZuQc

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2600	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2656-0-0x0000000000940000-0x0000000000968000-memory.dmp	upx
behavioral1/files/0x002a000000014b6d-2.dat	upx
behavioral1/memory/2600-7-0x0000000000F60000-0x0000000000F88000-memory.dmp	upx
behavioral1/memory/2656-8-0x0000000000940000-0x0000000000968000-memory.dmp	upx
behavioral1/memory/2656-10-0x0000000000940000-0x0000000000968000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2600	2656	9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe	28
PID 2656 wrote to memory of 2600	2656	9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe	28
PID 2656 wrote to memory of 2600	2656	9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe	28
PID 2656 wrote to memory of 2600	2656	9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9230a7115cc5c55ebfa095e62fd7a290_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2656
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
a681cfc97f1b0bd8c5df2d5eae436755

SHA1
9a560feda0dee5e3af4bbbc430e0ed1a9a2fae64

SHA256
43aad04df34e7bdb813a5566ae79199d9ff1cfc511b540d409f180d3d9cb5c09

SHA512
0cb195c11f9ee1c3e7686cd11bffaf54ff023bcd8ae6313a12cbce569f0227e35d73ec38b73074354ea26983472cdf4394f058d408ddb56575e5e1507ad574f7

Download Submit
memory/2600-7-0x0000000000F60000-0x0000000000F88000-memory.dmp

Filesize
160KB

Download
memory/2656-0-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/2656-6-0x00000000000F0000-0x0000000000118000-memory.dmp

Filesize
160KB

Download
memory/2656-8-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/2656-9-0x00000000000F0000-0x0000000000118000-memory.dmp

Filesize
160KB

Download
memory/2656-10-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads