ebcf82f1e3c378cd0eab9173650fc4d9f07abcfe6edb5d6487a59fecffb02da4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
769efcf6e4e2d7f2d587a299f38d4cd0_NeikiAnalytics.exe
Size 493KB
Sample240602-2c4epahc5v
SHA256 ebcf82f1e3c378cd0eab9173650fc4d9f07abcfe6edb5d6487a59fecffb02da4
MD5 769efcf6e4e2d7f2d587a299f38d4cd0
SHA1 523c649c0eee4ab84b1afa0de6e90b1bf4ef9ec7
SHA512 7cd817cc590b3732dbd4df9b79ae635a051aa4774060e8f53ee482b5d03aaa6c316035e115aab55e004689a2ed91a961f707be8f9ebe6eb7b57938b586fb3c9d
SSDEEP 12288:NyAfDcgcTQhgpZBDtoRAG01LqTl2mZoi0Q:vDVBADt1ZKlXF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4396	EXE3911.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4396	EXE3911.tmp
4396	EXE3911.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4396	3624	769efcf6e4e2d7f2d587a299f38d4cd0_NeikiAnalytics.exe	83
PID 3624 wrote to memory of 4396	3624	769efcf6e4e2d7f2d587a299f38d4cd0_NeikiAnalytics.exe	83
PID 3624 wrote to memory of 4396	3624	769efcf6e4e2d7f2d587a299f38d4cd0_NeikiAnalytics.exe	83
PID 4396 wrote to memory of 4752	4396	EXE3911.tmp	84
PID 4396 wrote to memory of 4752	4396	EXE3911.tmp	84

C:\Users\Admin\AppData\Local\Temp\769efcf6e4e2d7f2d587a299f38d4cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\769efcf6e4e2d7f2d587a299f38d4cd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\EXE3911.tmp
  "C:\Users\Admin\AppData\Local\Temp\EXE3911.tmp" "C:\Users\Admin\AppData\Local\Temp\OFM3912.tmp" "C:\Users\Admin\AppData\Local\Temp\769efcf6e4e2d7f2d587a299f38d4cd0_NeikiAnalytics.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EXE3911.tmp

Path C:\Users\Admin\AppData\Local\Temp\EXE3911.tmp
Size 968KB
SHA256 e6090962c2504441c1cd5f6ee75dd5ffbddc38062f02807f0d44176d8f464381
MD5 0f619e7352920d8d21926f2b715e0794
SHA1 cdd75d72647b1c75477c069b51b5f8ab5dc63e50
SHA512 380592a1382f40d80839efea429619470b09fc0c0aad8666c6392d8dbd112f5e8719538fc93044454f4ce67375aaae8da59e09563b167ff8adf34240be684dae
SSDEEP 12288:GEUAMIm8vpoALHsGzfsFK0CIpfJl9thEidLxbhWqgjLv3vy:GEUAFm8hoALHZfN0CIJP9McRN4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

OFM3912.tmp

Path C:\Users\Admin\AppData\Local\Temp\OFM3912.tmp
Size 48KB
SHA256 807bed9aa0b06e1009bd09749e600dfdf935019cd75a353430e4f08cbc2521e1
MD5 9163aeac9d01fbb11d2d209e32b732c9
SHA1 19093ba3245639446804a944a5755a127218fb23
SHA512 a7b7b30a4bc1c1f4167c10f510b46a2005a634abab9cd2f0ceb6083cc689bc30d430d864dfd628fe350900ece1a8d17731c7175f810ac511ff5ce6bc91f8496f
SSDEEP 384:BJ1Yu1ZDyPt5NElJr146WKXVihWZCXDEnnjyDGiLs1YuH:B/yXNEll1YBBDEnjOJ2
MD5 SHA1 SHA512 SSDEEP