Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 22:32

General

  • Target

    77695da7de7843205618d680e03c3b00_NeikiAnalytics.exe

  • Size

    52KB

  • MD5

    77695da7de7843205618d680e03c3b00

  • SHA1

    f87f413a9f367dcbf431c9bef5a3d407f5ef0536

  • SHA256

    1d2883cdc56f52f0ff42ce55a13f3301ad2439fbc61cceef412fddfb7665a2a9

  • SHA512

    43f6e639787a0ace26d3779f41e73a217620510f16dbce1029d5014bd4f618885d7dc12472a6e9e5fdda9534e284972537f3ee7b7f8d2f779c086575033c3fe7

  • SSDEEP

    768:4oMn6f9zSX3e3cZ9SoD8XD33fyEpk58sCuSNcIcXR/QGQeCa57qEQwLGVPlp:26f9uusDSoDEXC58kSEYFa1vnLalp

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77695da7de7843205618d680e03c3b00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\77695da7de7843205618d680e03c3b00_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\upsec.exe
      "C:\Users\Admin\AppData\Local\Temp\upsec.exe"
      2⤵
      • Executes dropped EXE
      PID:3004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\upsec.exe

    Filesize

    53KB

    MD5

    69e1f0162a1787aedae977bcab7beb5e

    SHA1

    86a00adf6bdf1e7c5b0e70b06211fff09ccf99b3

    SHA256

    17c65a4797ef021bd86ba7cd227096a5c65dbe359a6f838e536fc0886321d8b4

    SHA512

    4669e8beb9f0b294b421132e32338ee0e3e0fdf3e0584d7d5ac3856219c3e25200ef01d912a1d21277cfa3d96e8d7e3cbd99fe5e2246f7366108e054f7159f0f

  • memory/2188-0-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2188-1-0x0000000004000000-0x0000000004005000-memory.dmp

    Filesize

    20KB

  • memory/2188-2-0x0000000004000000-0x0000000004005000-memory.dmp

    Filesize

    20KB

  • memory/2188-6-0x0000000002D20000-0x0000000002D32000-memory.dmp

    Filesize

    72KB

  • memory/2188-11-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/3004-12-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/3004-16-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/3004-18-0x0000000004000000-0x0000000004005000-memory.dmp

    Filesize

    20KB