8a205eb2de82354fba17ef8793ba5f99cfcb3a8b830f485d0fe0f7b2833065d9

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
Size 9.5MB
Sample240603-qa99nsfc91
SHA256 8a205eb2de82354fba17ef8793ba5f99cfcb3a8b830f485d0fe0f7b2833065d9
MD5 a45e2482beb82d36042e23a506a1ffd0
SHA1 3d07fcb1ccd7a96e65a4942ae31ea4b59aa3a362
SHA512 0c98d9c8ace3f0c9d4dc26895935e1ca32739051ca6fcf3bcea392b2a66e5156931a7ab1f5c6580ba4638345c228a7d37c7e396ed079f5c709f9d9581a7ebd62
SSDEEP 196608:jSeE2E7TdIyHRhCrtAriSzyRKKYFBlags9qltnoFbaxc4GBGiadQSs0nqVCrxsp:jSJN57eKiJCUSnaax4QlQShkCr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2516	arphaCrashReport64.exe

Loads dropped DLL 4 IoCs

pid	Process
2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
2516	arphaCrashReport64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2516	2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe	28
PID 2344 wrote to memory of 2516	2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe	28
PID 2344 wrote to memory of 2516	2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe	28
PID 2344 wrote to memory of 2516	2344	a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\arphaCrashReport\arphaCrashReport64.exe
  "C:\Users\Admin\AppData\Local\arphaCrashReport\arphaCrashReport64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.dat

Path C:\Users\Admin\AppData\Local\arphaCrashReport\app.dat
Size 8.9MB
SHA256 eee158549fa308efe76e288d714585c1273f7fee778f889b135ed5d14a04f0bb
MD5 9fe2865cfa2e9d4e2ec4aa2a151e24a8
SHA1 58eb6fe8804e1ef56b69b1273a0c58f249c18b67
SHA512 010448bd00edab88bde3cbe0c5ba3bd6314c8f2a80e1b46f3936bdd16e1780fb3b6b0771c93927c06a2db748e06f9db298bfbed6ff25e3b1d73e87347356d329
SSDEEP 196608:jOY0ESi+gTGvrKb9XddutJywcdWi60SjL3CmtNn1bbV1JcZ8:jOjXi+gTgrSRutJywcCfjL3Ci1bzmZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

arphaDump64.dll

Path C:\Users\Admin\AppData\Local\arphaCrashReport\arphaDump64.dll
Size 3.4MB
SHA256 a5736a1535c81b3a15a5589cc0717a20e05fce0201bed7be96dbacca1fc47da2
MD5 daacd794a6cbf927804a158cfaf14b09
SHA1 a8247e9ee7c40423d0a8e14a41dc2713699c7860
SHA512 edc0abfcc92ab51cc2578d2b0288b4df3af6aad02f983303073a137e0b8fbcb25e0c151e386fbe0b2dca279645cfc50fd53192c655af5884e8d8d2846d5f6686
SSDEEP 98304:fCJTfEYHRjVHPCIq6UC98RRMjQNJX/sipEC2:GTsIpqkUCe4QvX/5p4
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path \Users\Admin\AppData\Local\Temp\nso90EB.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

Submit Download

arphaCrashReport64.exe

Path \Users\Admin\AppData\Local\arphaCrashReport\arphaCrashReport64.exe
Size 233KB
SHA256 2b9a7960a5d7cc77318af937cadd47270fe5ada6e42067c241a2b9b0830c5f2c
MD5 da5f97cab6279eed78b6f1d47aa267ed
SHA1 6ae39162d0e1e32c0a8a51baaf3fab491a37c3f3
SHA512 a1fbc66ffbb99f09a91487b5d2bf9285e76184fe23d3045b5b1eee185943541a9bbcdfbf33acf5edc754d8d25cec2e5ad823d477f57f3bcf00ac11792a510552
SSDEEP 3072:TN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L0puG:PZ5qomPSeCx7tRNQjSo
MD5 SHA1 SHA512 SSDEEP

Submit Download