Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
02/06/2024, 07:05
General
-
Target
4d8d03db235bd45000b8e25004aebc30_NeikiAnalytics.exe
-
Size
139KB
-
MD5
4d8d03db235bd45000b8e25004aebc30
-
SHA1
eb778899811ae82568341b2b67910fcbb2270261
-
SHA256
f7ffcfa692e0ed4208e547fcd351ab3d88b9397792af2171f9dfa6367516b47d
-
SHA512
36afdc0574b70689f0f7f4edaaa8fca97eb575ecb0701add492b8585fcdff02df07ccaa1880c1d718b9da35c1e639c13ac6f91bb61f6321ef1df95e846074ab6
-
SSDEEP
1536:DfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXb1GF5McSrJJJJJJJY:DVqoCl/YgjxEufVU0TbTyDDal5GF5oy
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d8d03db235bd45000b8e25004aebc30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d8d03db235bd45000b8e25004aebc30_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD512abcfa7c7cd68ee0775412e8dca6c69
SHA11f54e2bc058c55c67847a135f3874a583d710133
SHA25625cfc3fd7e755343867db8661fc9aec238f873f440df0aadeacc70fbda566401
SHA5122ecb35a4e96a9ad375e7c70bf55827d9eb1d671ecfda5e3f5f69e8bdc26e6b611b61fa7509ad3a538c78db22e093e1ec841c1c0627eaafb82df0c38558025d8e
-
Filesize
139KB
MD59a9757f32d6b2ffb7e91834ba1aff4b1
SHA1c1ac890710efbe3553a0bac5475b614f7ee79980
SHA256c62b6f1907bbc2409399df0f1a8a2e7a95e09c87f95a46ec347ca13feed63a79
SHA512ee87f9e2b0200ab1fee7c7ab810f266d0cc52949fc34cfb3ee65b1d721ecd62e9cac9f706eebfe2d7536c1e50c1bc1f9c287f02bc7c3cf96cb4938cf9ce20329
-
Filesize
139KB
MD5fe481eeb3b5fc55251232d47fcc9b3f2
SHA1f4fbe8b8d349c2f382d0be1f0acd50da55a38a60
SHA256c837cf33e45b2aa56b0d896fb9fe5be508419c074c87dba9ba249150ee2f3284
SHA512c6267ca394c62fae8d41ab7dada7755d78da0e979004911c9d17d571751dbd736eb7afe5f232b2eda14d9efad4b5e71ec47c223540c5ca058cc50dc51f9606c3
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB