2c05cd4ec43261708b0109c8a9110e46a68626d565be8d6c62dd5c5cb32cc7a0

General

Target

ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe
Size

927KB
MD5

ca171d29460a6c6e06ebf98362c8cd50
SHA1

553b8212bdc3f8b0d3e00742502b553ef4972e9e
SHA256

2c05cd4ec43261708b0109c8a9110e46a68626d565be8d6c62dd5c5cb32cc7a0
SHA512

a7ab9a9656a9a6af9abfd4ce857b4eab3319cdf0e45050139ca8a7e4684d17221e38035f8992bcede6a51b74508319c56414daaf8b6f75812c6aa873c7121119
SSDEEP

24576:WbN+yZe0p4Ek4niOkl/A04szE87JKTvmn:WbN+ieW4SkZP4sz9MbQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2876	MSWDM.EXE
400	MSWDM.EXE
2848	CA171D29460A6C6E06EBF98362C8CD50_NEIKIANALYTICS.EXE

Loads dropped DLL 2 IoCs

pid	Process
2876	MSWDM.EXE
2876	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev63A3.tmp	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2876	MSWDM.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	CA171D29460A6C6E06EBF98362C8CD50_NEIKIANALYTICS.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2848	CA171D29460A6C6E06EBF98362C8CD50_NEIKIANALYTICS.EXE
Token: 35	2848	CA171D29460A6C6E06EBF98362C8CD50_NEIKIANALYTICS.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 400	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	28
PID 2988 wrote to memory of 400	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	28
PID 2988 wrote to memory of 400	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	28
PID 2988 wrote to memory of 400	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	28
PID 2988 wrote to memory of 2876	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2876	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2876	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2876	2988	ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 2848	2876	MSWDM.EXE	30
PID 2876 wrote to memory of 2848	2876	MSWDM.EXE	30
PID 2876 wrote to memory of 2848	2876	MSWDM.EXE	30
PID 2876 wrote to memory of 2848	2876	MSWDM.EXE	30

C:\Users\Admin\AppData\Local\Temp\ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2988
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:400
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev63A3.tmp!C:\Users\Admin\AppData\Local\Temp\ca171d29460a6c6e06ebf98362c8cd50_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\CA171D29460A6C6E06EBF98362C8CD50_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MSWDM.EXE

Filesize
80KB

MD5
f953eee07963c184dd80c54fe6d036a5

SHA1
c09ef25a25722b434f31e2e4ae9a53a77abfdb66

SHA256
58fe341cf6d3034c6b660f49e9619d7c9a189f1eca079e1aac0daf062d322fba

SHA512
4fb4d94008673a649f59e2e1971840d066f31808490ae8939f8d0c87995b39494a513c14ea3d8ed1966b13a268b80d923103bda27ff6c1dc64be938f1437fb95

Download Submit
C:\Windows\dev63A3.tmp

Filesize
847KB

MD5
c8f40f25f783a52262bdaedeb5555427

SHA1
e45e198607c8d7398745baa71780e3e7a2f6deca

SHA256
e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316

SHA512
f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191

Download Submit
memory/400-23-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/400-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2876-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2988-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2988-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads