a06ea97f46eda3a30bb2beb4ff29ddaf090572b6360a9070466cb35aeb38ed61

Analysis

max time kernel
19s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
Size 538KB
Sample240602-2e2nwahd4x
SHA256 a06ea97f46eda3a30bb2beb4ff29ddaf090572b6360a9070466cb35aeb38ed61
MD5 770b9f21be037db81308428cc0177cf0
SHA1 c4a78f538aa6bd849f6d2d111a115afe5d856641
SHA512 32a16f4032d7a9b02cb43d316943a81a830fde9c10f158b27338ce96fe40600af98340e973f986104aca9c9036e7a4421f6ce5920bbfcf1df7fd64f0ef4affd1
SSDEEP 12288:wlbv+h1gL5pRTcAkS/3hzN8qE43fm78VT:Wbv+w5jcAkSYqyET
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2348	MSWDM.EXE
2616	MSWDM.EXE
2800	770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE
2484	MSWDM.EXE

Loads dropped DLL 2 IoCs

pid	Process
2616	MSWDM.EXE
2808	Process not Found

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev1CF3.tmp	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev1CF3.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2616	MSWDM.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2348	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	28
PID 2092 wrote to memory of 2348	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	28
PID 2092 wrote to memory of 2348	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	28
PID 2092 wrote to memory of 2348	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	28
PID 2092 wrote to memory of 2616	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	29
PID 2092 wrote to memory of 2616	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	29
PID 2092 wrote to memory of 2616	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	29
PID 2092 wrote to memory of 2616	2092	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	29
PID 2616 wrote to memory of 2800	2616	MSWDM.EXE	30
PID 2616 wrote to memory of 2800	2616	MSWDM.EXE	30
PID 2616 wrote to memory of 2800	2616	MSWDM.EXE	30
PID 2616 wrote to memory of 2800	2616	MSWDM.EXE	30
PID 2616 wrote to memory of 2484	2616	MSWDM.EXE	32
PID 2616 wrote to memory of 2484	2616	MSWDM.EXE	32
PID 2616 wrote to memory of 2484	2616	MSWDM.EXE	32
PID 2616 wrote to memory of 2484	2616	MSWDM.EXE	32

C:\Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2092
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2348
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev1CF3.tmp!C:\Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:2800
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev1CF3.tmp!C:\Users\Admin\AppData\Local\Temp\770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE

Path C:\Users\Admin\AppData\Local\Temp\770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE
Size 538KB
SHA256 abab6fb111136fc7664ff82566f3b1527d3691cdaf2829fd17c1675b1624f697
MD5 ae412c5be742750d5bd495f4a8078eef
SHA1 4acdeec5416d81d2d9958dc117060a7f1f72ee0c
SHA512 201b38271b996f6e70c726feed72c051e7c873bcf9ad7c888f7037a27f9ec17529fa853ecd56a651124370d281b0773a4d69205deaedd79e8658b5a05dd524cb
SSDEEP 12288:wlbv+h1gL5pRTcAkS/3hzN8qE43fm78VW:Wbv+w5jcAkSYqyEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 f3e6467d75a933b1d1beaf0b51db217f138b84b202fcee882ddbd7aa7b08c9ec
MD5 d47423d8c8d2010083acb8844d490ec3
SHA1 3d2fabb92edc74b82d083a8a3be6ba84bceff143
SHA512 d7a5cfa107daf7b501e8037b66e5771caf773da3bd7cb95535b361067bef60567350f68bffa298a890597be9e96f068d1dd6ace86e0884b701abb0e495020d05
SSDEEP 1536:Hlqls0GgUyj5JxdA4Oj3W2Fsdq4FtgG+sdguxnSngBNpT/mzNnxPAxEAz0+/u:HQC/yj5JO3MntgG+Hu54Fx4xE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe

Path \Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2092-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2092-13-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2348-33-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2484-29-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2616-18-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2616-23-0x0000000000250000-0x000000000026B000-memory.dmp

Download

memory/2616-32-0x0000000000400000-0x000000000041B000-memory.dmp

Download