Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-06-2024 17:33
General
-
Target
4172abfc9ca3cda77f3eff2f6d398310_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
4172abfc9ca3cda77f3eff2f6d398310
-
SHA1
980d13bf8904a18bc31f83ce4865b98881fbd6fd
-
SHA256
2bb6cf1695905b045958583304026ee2e1173e86cc82271c204efb9c1436c30e
-
SHA512
a1247f987426f0b3181dc4478248b7be16960564bb6ac33f812eb990caf713eccb73387f748f162b71820e215ec406d84936e77a3201170bf552104e68ff3f8e
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBd9w4Sx:+R0pI/IQlUoMPdmpSpR4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4172abfc9ca3cda77f3eff2f6d398310_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4172abfc9ca3cda77f3eff2f6d398310_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesVX\abodloc.exeC:\FilesVX\abodloc.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD56068e78a21ee1743b71b7314b3bd2305
SHA10a04df332fcfab0021b5ab7a1f0b218ffeb85897
SHA25680fc33c93bfac651cd83ac885ab1bec4a9b1c8043b4a047f80652f1939d0da4a
SHA512be13c891449febba7e5459ce1e3e012148c180b77352e3fc54e1d99f2cf3fa28d133d377fc5bfc49f9f441e7b31616c5d135e05c1846f34a40484ae7149541d3
-
Filesize
2.7MB
MD58e72ed395483b5b4fc17644346558f37
SHA1f7d441c3ca882e55c451fdf06bb8b37e66b61ecc
SHA256a2658781dfe8fe5e08328bcf29f5f0f66407180dcbfb38927c6254e40cc091ac
SHA512b142afa3dc69abfed861458149e3f4569b55c11c1a8a5fae2f92d02e2967910c78b767db484c73ce872582b84264396764a4b3f895ac18a3bd0aeca9217a4314
-
Filesize
206B
MD5e095f355b60e6ef92a1a4d0b68815d96
SHA1b12bdf93f3a4cf1911a131457240bdbe6c5c7c9a
SHA256d4a3a7f5aa444baa7c1892873bff5d0270ca82f065b1606c7f00807535ab203d
SHA5120b4af3ccb0e525a36f39e0ee518f1a557c0c81941e3364d7952d4cdbccba8ded01c3edf82ea8dff9c0a0af135fe05524ac8d28ac118b9628be23de35b64191b7