2d172d3a84faf1c5fc2a8b3b087d74450a8bddf3bd8c21dac61d1f84f23efa02

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe
Size 12KB
Sample240603-m7khqscc4x
SHA256 2d172d3a84faf1c5fc2a8b3b087d74450a8bddf3bd8c21dac61d1f84f23efa02
MD5 a1299921a906a1ce1502cd3fec750e70
SHA1 b9bc5624b9302198dd5170d49142c45d8babfa81
SHA512 17567fb430a728eab5bb9af354484d4d577ff6a9f995fa92a883d091294008338d3495e1ce904965331b911e799f07086f89315bd5a4ccfb1128b84b7554aa35
SSDEEP 384:/L7li/2zUq2DcEQvdhcJKLTp/NK9xaxb:zIM/Q9cxb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2504	tmp15E2.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2504	tmp15E2.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2944	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	28
PID 2004 wrote to memory of 2944	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	28
PID 2004 wrote to memory of 2944	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	28
PID 2004 wrote to memory of 2944	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2944 wrote to memory of 2672	2944	vbc.exe	30
PID 2004 wrote to memory of 2504	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 2504	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 2504	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 2504	2004	a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe	31

C:\Users\Admin\AppData\Local\Temp\a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dmfe4bte\dmfe4bte.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1719.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21F14AE0DB7E46CAA090EF52BDD84C3E.TMP"
    3⤵
    PID:2672
- C:\Users\Admin\AppData\Local\Temp\tmp15E2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp15E2.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a1299921a906a1ce1502cd3fec750e70_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 ab93f0739556adfb881e9cc0f0eaf657dc64f21716f4513b8cd6c211825e80f1
MD5 a608f3d17cf3e13a09f79f83671a3237
SHA1 32eb5211499900d9e97742810d5207f9b51c0c01
SHA512 8c314efae68f7346e5f9b72c5a50f8d0fae752f9055950beba3560f8e39bf19582a24f31ae3ea87e117db1e43b1759074e298dcd37d86c845cd45454bc685777
MD5 SHA1 SHA512

Submit Download

RES1719.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1719.tmp
Size 1KB
SHA256 144d48841e2d268cc26f29210b0c0e621b36d87504920fbdac3b1fceede68b92
MD5 d85e6475f7ed309d69d5ab85af31293e
SHA1 58aa3d49bde149a9f66ec4af36598eb0370bef20
SHA512 72d1124227337c8e61ec9bcd3c44f5fb531f6016d28d4906dfd6eaf2beb9a957f76eaa444514c2aefa0813bb47f373146db61c49dfad498a226b810dd2546723
MD5 SHA1 SHA512

Submit Download

dmfe4bte.0.vb

Path C:\Users\Admin\AppData\Local\Temp\dmfe4bte\dmfe4bte.0.vb
Size 2KB
SHA256 e01e133e16a7257117c76e3dc18a3cfa935a19277a747f6fcb40d61096630564
MD5 aad386b656968393dadadc31077f08cd
SHA1 e6f8fab527f199d3b14233d32069e23ead986aa9
SHA512 2feb01b1587dffda12578d870fcae242100d3a16ed9803d21200026e823e7c839479f4ca071e479b0df34f32c4567c921b37872ddf7cdef4796d04204edeb394
MD5 SHA1 SHA512

Submit Download

dmfe4bte.cmdline

Path C:\Users\Admin\AppData\Local\Temp\dmfe4bte\dmfe4bte.cmdline
Size 273B
SHA256 c386b07ad604953c2e07395f19a1fc304e378ec3e2d575b6fa8576d7e6aa2e1f
MD5 bf345e38390f8036d5ad2e38baa89d8f
SHA1 3a7015412a807e0126d832fa6f34daf7acaa89fa
SHA512 277b02bd44816335a9b2513ba2f5dcf71117f4c7d7a3aa56785352eae905f3bd5f28c02dd9bc25d85c6c79e329d9d82bcc8bd8593b50eb6639bf1fa15edd0c69
MD5 SHA1 SHA512

Submit Download

tmp15E2.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp15E2.tmp.exe
Size 12KB
SHA256 465968eaa8822033cf3d3a89c71a684844c331bdf655614797cbc89542ad4c9c
MD5 e8673d461a80c22cf5f8debf89ecd4e5
SHA1 16bcd034d404fd12cab145b35b4903f5e9785b20
SHA512 36997be0bb6554588d36cbb5a4344acc13258205b13b790639a523fb3c287714191da3a62a21b20445a1e963af71dc293802ae09f545826d69c835c226cb02b4
SSDEEP 384:nL7li/2zEq2DcEQvdQcJKLTp/NK9xaepR:LoMCQ9cepR
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc21F14AE0DB7E46CAA090EF52BDD84C3E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc21F14AE0DB7E46CAA090EF52BDD84C3E.TMP
Size 1KB
SHA256 26e74421fb0bf4ae06b68f352a9adbfb1869da86ccacfc8b0d1c422a1cc98f7b
MD5 a7f7dd06732431b516a5ecdc2c40c653
SHA1 d2170d380172dc3e454f8f7df366f3efd0e06155
SHA512 5b5da50b6b7d4de6b0f04ca2dc5426bf399ca512b954dca66dd4f8abde0105de3966470d13d1031264696900eb708e4a3bcd6fa0b6e105c8e2224fb8e754cad0
MD5 SHA1 SHA512

Submit Download

memory/2004-0-0x000000007452E000-0x000000007452F000-memory.dmp

Download

memory/2004-1-0x0000000000C00000-0x0000000000C0A000-memory.dmp

Download

memory/2004-7-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2004-24-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/2504-23-0x00000000013D0000-0x00000000013DA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads