ca91d546897093a21f36ca7a5845ed262a72c39636403f61f867aeb2f4d1f862

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe
Size

510KB
MD5

42f4f34fd5cd637f1f4028d602e4a980
SHA1

e6c4d8c597f462ef4b40d33efd5d9c351ad09207
SHA256

ca91d546897093a21f36ca7a5845ed262a72c39636403f61f867aeb2f4d1f862
SHA512

8ac1c38593bce33a625f1aec05e5f81914d9a760219f59abb493ef0549425d440ccb968273bddf24d1fca4a43710aae725e44124d32646ce71c9c65fafa47dab
SSDEEP

12288:KkheH6hZYOYrInJ0JvQNy0+wcXP46sBmbvsTlgGrLfhtjQci:KkheahZnnJsvQNy0+wcXPkB9TbfhtS

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2884	jrun32.exe
2512	jrun32.exe
2352	jrun32.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe
2360	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1916-0-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/1916-3-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/1916-4-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/1916-23-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/files/0x0036000000015670-30.dat	upx
behavioral1/memory/2884-38-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/2360-36-0x0000000000410000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/2884-42-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/2884-53-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/2884-83-0x0000000000400000-0x0000000000496000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrun32 = "C:\\Users\\Admin\\AppData\\Roaming\\AppData\\jrun32.exe -notray"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 2884 set thread context of 2512	2884	jrun32.exe	30
PID 2884 set thread context of 2352	2884	jrun32.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2844	ipconfig.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
336	reg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe
2360	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe
2884	jrun32.exe
2512	jrun32.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 2360	1916	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	28
PID 2360 wrote to memory of 2884	2360	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2884	2360	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2884	2360	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2884	2360	42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe	29
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2512	2884	jrun32.exe	30
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2884 wrote to memory of 2352	2884	jrun32.exe	31
PID 2512 wrote to memory of 2844	2512	jrun32.exe	32
PID 2512 wrote to memory of 2844	2512	jrun32.exe	32
PID 2512 wrote to memory of 2844	2512	jrun32.exe	32
PID 2512 wrote to memory of 2844	2512	jrun32.exe	32
PID 2512 wrote to memory of 2844	2512	jrun32.exe	32
PID 2512 wrote to memory of 2844	2512	jrun32.exe	32
PID 2844 wrote to memory of 1948	2844	ipconfig.exe	34
PID 2844 wrote to memory of 1948	2844	ipconfig.exe	34
PID 2844 wrote to memory of 1948	2844	ipconfig.exe	34
PID 2844 wrote to memory of 1948	2844	ipconfig.exe	34
PID 1948 wrote to memory of 336	1948	cmd.exe	36
PID 1948 wrote to memory of 336	1948	cmd.exe	36
PID 1948 wrote to memory of 336	1948	cmd.exe	36
PID 1948 wrote to memory of 336	1948	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\42f4f34fd5cd637f1f4028d602e4a980_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe
    C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe
      "C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        Suspicious use of WriteProcessMemory
        
        PID:2844
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YRLDJQBC.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jrun32 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe -notray" /f
        7⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:336
  - - C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe
      "C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe"
      4⤵
      Executes dropped EXE
      PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\YRLDJQBC.bat

Filesize
146B

MD5
f43ed9d2c73208eded7959a9b78c7814

SHA1
d8f0db46acffd54bd87051ad8e46f73b8dd47961

SHA256
707c5b61af860c851e76c8173f36a852089f68985a25356b1e47711265cea7f6

SHA512
b06f43d4029e372a53b36df2fc3091b7b546c65074770da3adb88be3c96c4288cc0247fb7408804f96ddbb6df305f230f288aa30355bf7b22865216130671d0d

Download Submit
\Users\Admin\AppData\Roaming\AppData\jrun32.exe

Filesize
510KB

MD5
e0f3193945a2dfdb4d9a1bd8b771d838

SHA1
01cfe1b1b35334aa1b3d06bf64cbe3a0b4bbb497

SHA256
990abf62e26e4dde5dd0769fcf770a8e45688f1e7d5915dc62331bcef3139257

SHA512
d8111df58a5f918c35a5315c9e0c5fb0b39aed411265183d6fe5fb50fbacc95f362fb508bb22db4f79ac5574dc57ac603a404a28937eba0f53134c66289711a0

Download Submit
memory/1916-3-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1916-4-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1916-23-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1916-22-0x0000000006000000-0x0000000006096000-memory.dmp

Filesize
600KB

Download
memory/1916-21-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1916-20-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1916-19-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1916-18-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1916-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2352-92-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-97-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-105-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-82-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-84-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-89-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-90-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-91-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-93-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-76-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-72-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-70-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-68-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-66-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-64-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-62-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-60-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-94-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-96-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2352-95-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2360-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2360-5-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2360-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2360-41-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2360-36-0x0000000000410000-0x00000000004A6000-memory.dmp

Filesize
600KB

Download
memory/2360-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2360-24-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2512-100-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2844-85-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2884-83-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2884-38-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2884-42-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2884-53-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads