161f9df3b4d00c5891f5797d0c208fcd01bff6518581f6540f8a8748f097dac0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe
Size 12KB
Sample240602-2b7eysac85
SHA256 161f9df3b4d00c5891f5797d0c208fcd01bff6518581f6540f8a8748f097dac0
MD5 766cee9061cbc8d629d749c22bb528f0
SHA1 89e932eb1767148ab8f8c1abab3a208f1408aef0
SHA512 860da66a926f0cf6fe733dd4ff57c47820154139186c7d06c2ae859428a1ad6658de140e9ee74eb1ecbcc72ae1aaa34167b00b9d0310bca2445f15098336c6df
SSDEEP 384:TL7li/2zVq2DcEQvdhcJKLTp/NK9xa2q:3FM/Q9c2q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2096	tmp1611.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	tmp1611.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2944	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	28
PID 2004 wrote to memory of 2944	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	28
PID 2004 wrote to memory of 2944	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	28
PID 2004 wrote to memory of 2944	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2004 wrote to memory of 2096	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 2096	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 2096	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 2096	2004	766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe	31

C:\Users\Admin\AppData\Local\Temp\766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rzwkbm1h\rzwkbm1h.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1729.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc46A05E8A8E1C4372AD8EE65BAB71A56B.TMP"
    3⤵
    PID:2672
- C:\Users\Admin\AppData\Local\Temp\tmp1611.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp1611.tmp.exe" C:\Users\Admin\AppData\Local\Temp\766cee9061cbc8d629d749c22bb528f0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 ab61b771d5ad717c41763efa84c3755e853540dc66cdd25ab25f90370396c916
MD5 63cbcc42012be7543118d402f115e762
SHA1 ed3c87b3bc0efe588a18af718c7c8c4f68c900ce
SHA512 0dcaac3285dd7743b4e1642c236c7dcaa0cce7f3204cd8c7231f8b644099defb0b09e85705d78df86f0d9843d868936b73ec4fe5127548a4bf935ff6d8d04ab6
MD5 SHA1 SHA512

Submit Download

RES1729.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1729.tmp
Size 1KB
SHA256 e53ad7e3b147e43936dc931d45fc2e42aa2562a387916eb2e8969a40fed0b3e8
MD5 f0d8ebfadc316543faa254d988e83b81
SHA1 0bfaa1aaf221ee5e9144a5dcf777cd23db8119ef
SHA512 8a875eb5e03f9550eafbf2b6478c1203bcb4d24e34139427cdf26cbbba6802651672ee2fc5d60ea53bad835ce73f6a74abf3f9066bbae2ac5e1cc6c6cffc1e55
MD5 SHA1 SHA512

Submit Download

rzwkbm1h.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rzwkbm1h\rzwkbm1h.0.vb
Size 2KB
SHA256 cea591bf4779a430ecc3c7c9f81e04e1309353f13476cce9a6eef360cdb7834f
MD5 923063760f099bd706b9ef84a84eadf4
SHA1 cdbea57b04b94f484fba1b805f7c3d3eb2d07dd4
SHA512 388d75113d133f083ff7339b860ff19abe3a52e5ccc4ffad8bf1eb6d94119f68f29e85f1fc33766fc6fe703e1ca951907ba99494f19dd0f1078511fcd8087f94
MD5 SHA1 SHA512

Submit Download

rzwkbm1h.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rzwkbm1h\rzwkbm1h.cmdline
Size 273B
SHA256 8786cc59298f933f63773fdbdea4614d99efe448fad0c10048cdf72117bda263
MD5 a242656a267bbfc3a87d8c5368bc64cc
SHA1 284e5a57107b9df9bab0d418dcdaefd31c35f9cf
SHA512 dd5c3c8e20300424b74d21067ef4c043272948a08baba3f655578fe2ae2b8ca67793276359f758f5c0f0ef273a5ffa2da935c773ce5cf900ba7222cdb7edd251
MD5 SHA1 SHA512

Submit Download

tmp1611.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp1611.tmp.exe
Size 12KB
SHA256 b18cb653593f90090097484625012158389bebbb64fd56252152877e2a5b050f
MD5 fc3c5e95b1d4dd17ab14e44bb9962059
SHA1 b51e72e767ac070735f1c8b37735d5dd7fe77e57
SHA512 3b3d9a650bd6641ebd8cf6a6dc7ebe6fd81ad35885d21c78425e65c7a4912d9dced6ea043a0263b60e17c0fcbe49fc40441c66b4eaf20010413a2694c9ed3d04
SSDEEP 384:qL7li/2zkq2DcEQvdQcJKLTp/NK9xaZN:0gMCQ9cZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc46A05E8A8E1C4372AD8EE65BAB71A56B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc46A05E8A8E1C4372AD8EE65BAB71A56B.TMP
Size 1KB
SHA256 379d55647159cd77ebe6485098086b0517b62fc1b87e996ea0960ba3fd570d05
MD5 883c27b5d744135d8b4aed574445ef3d
SHA1 452470b3b3f3ec91c362de72aba46116000649d0
SHA512 ffa0f671315c14ec4ab5dc4ec0b7d607ace88b5e8fd0679add6a725fca1eedf6f79070f066227d4b63eca48cf038c0c924cd6d5deeb7ec2d979fc029ebfaf65e
MD5 SHA1 SHA512

Submit Download

memory/2004-0-0x000000007452E000-0x000000007452F000-memory.dmp

Download

memory/2004-1-0x0000000000D90000-0x0000000000D9A000-memory.dmp

Download

memory/2004-8-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2004-24-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2096-23-0x00000000012A0000-0x00000000012AA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads