a06ea97f46eda3a30bb2beb4ff29ddaf090572b6360a9070466cb35aeb38ed61

Analysis

max time kernel
25s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
Size 538KB
Sample240602-2e2nwahd4x
SHA256 a06ea97f46eda3a30bb2beb4ff29ddaf090572b6360a9070466cb35aeb38ed61
MD5 770b9f21be037db81308428cc0177cf0
SHA1 c4a78f538aa6bd849f6d2d111a115afe5d856641
SHA512 32a16f4032d7a9b02cb43d316943a81a830fde9c10f158b27338ce96fe40600af98340e973f986104aca9c9036e7a4421f6ce5920bbfcf1df7fd64f0ef4affd1
SSDEEP 12288:wlbv+h1gL5pRTcAkS/3hzN8qE43fm78VT:Wbv+w5jcAkSYqyET
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3436	MSWDM.EXE
212	MSWDM.EXE
3572	770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE
1452	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev493E.tmp	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev493E.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
212	MSWDM.EXE
212	MSWDM.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3436	3716	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	83
PID 3716 wrote to memory of 3436	3716	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	83
PID 3716 wrote to memory of 3436	3716	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	83
PID 3716 wrote to memory of 212	3716	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	84
PID 3716 wrote to memory of 212	3716	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	84
PID 3716 wrote to memory of 212	3716	770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe	84
PID 212 wrote to memory of 3572	212	MSWDM.EXE	85
PID 212 wrote to memory of 3572	212	MSWDM.EXE	85
PID 212 wrote to memory of 1452	212	MSWDM.EXE	87
PID 212 wrote to memory of 1452	212	MSWDM.EXE	87
PID 212 wrote to memory of 1452	212	MSWDM.EXE	87

C:\Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3716
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3436
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev493E.tmp!C:\Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:3572
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev493E.tmp!C:\Users\Admin\AppData\Local\Temp\770B9F21BE037DB81308428CC0177CF0_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\770b9f21be037db81308428cc0177cf0_NeikiAnalytics.exe
Size 538KB
SHA256 28a92a1fa297dac91c8626802cb4906f0820667f37e8e2e367247cbde1c3ea34
MD5 2c2e311863a5915590841185b9a9f8c8
SHA1 c2ff5e168576e3440810926ac0eee61a7b20043e
SHA512 72a06ba2b2685714c7664355bf4bfcaae7a9367382a31cab183e7511212dd831b7da69b2e52f3e88cf6066e31d4400d433580284f4108650f53cb8c0bd11c2db
SSDEEP 12288:wlbv+h1gL5pRTcAkS/3hzN8qE43fm78Vr:Wbv+w5jcAkSYqyEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 f3e6467d75a933b1d1beaf0b51db217f138b84b202fcee882ddbd7aa7b08c9ec
MD5 d47423d8c8d2010083acb8844d490ec3
SHA1 3d2fabb92edc74b82d083a8a3be6ba84bceff143
SHA512 d7a5cfa107daf7b501e8037b66e5771caf773da3bd7cb95535b361067bef60567350f68bffa298a890597be9e96f068d1dd6ace86e0884b701abb0e495020d05
SSDEEP 1536:Hlqls0GgUyj5JxdA4Oj3W2Fsdq4FtgG+sdguxnSngBNpT/mzNnxPAxEAz0+/u:HQC/yj5JO3MntgG+Hu54Fx4xE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

dev493E.tmp

Path C:\Windows\dev493E.tmp
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-12-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/212-25-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1452-17-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1452-22-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3436-11-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3436-26-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3716-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3716-10-0x0000000000400000-0x000000000041B000-memory.dmp

Download