Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04/06/2024, 05:32
General
-
Target
33081c21686c9d99b6c907e21492af90_NeikiAnalytics.exe
-
Size
212KB
-
MD5
33081c21686c9d99b6c907e21492af90
-
SHA1
bc5507c4bababd3032a7b808b8eabd03751af8a7
-
SHA256
f50d3c6c7335a2b543bcd537e9a39713c99e91c6496a149bad102b2c9e5483fd
-
SHA512
d8eb674533024ef9f5104a1396798c626e62021dced2fbbf6a78e5e6dde6da95a5fb97a46b65c33c9875d8d2cf0047c2befa82eb34d936cbdf8bafd39e15cbbf
-
SSDEEP
6144:GxNqLW6opBZMU/y/JEGjg+op2BSNCCr7/jU:gA6NBT/yEGjWwa7vU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 17 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33081c21686c9d99b6c907e21492af90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\33081c21686c9d99b6c907e21492af90_NeikiAnalytics.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
212KB
MD51f630bbf7a6cdb0350c578f8ef4c19df
SHA1419b4ed63361ab86b7498ce0a8492236f29772f2
SHA25600c43b7e6b2b6956a721a5c8bb44a0fb7ea61b49f1bec5eda101cd7a10c60690
SHA512f531135f4bedc0495dd4b3fc7aafe6a4225776e0fc46dac99d7e31b49f8f50bac968afa6a59360e8c09b215a05be029d291881dc69cd144787f79881747690c6
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
616KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
680KB
-
Filesize
616KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB