924639dfec92b9951c3b6c3e66420f4b23283bf1f1d14ae9abbd411962bd5752

Analysis

max time kernel
1s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe
Size

83KB
MD5

3e3047ebc94f352ba0c8ae0a526f8f80
SHA1

ea34cb1c2c82a415f08c9e5eb7914be66d2a29ac
SHA256

924639dfec92b9951c3b6c3e66420f4b23283bf1f1d14ae9abbd411962bd5752
SHA512

9eae2c6d874bc0087b8d92ab688e35afd9056d2d54451eaf86f8c51752e2b4946926547d14f8888164019dd78278c09f03fa73108b15c77707dcb6bbc20d0e1d
SSDEEP

1536:IGsBuoFn7UZ+LtdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsbI8zo:IGjot7UQLtdgI2MyzNORQtOflIwoHNVD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2308	kgfdfjdk.exe

Loads dropped DLL 1 IoCs

pid	Process
2328	3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2308	2328	3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe	28
PID 2328 wrote to memory of 2308	2328	3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe	28
PID 2328 wrote to memory of 2308	2328	3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe	28
PID 2328 wrote to memory of 2308	2328	3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3e3047ebc94f352ba0c8ae0a526f8f80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
  "C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe"
  2⤵
  - Executes dropped EXE
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe

Filesize
83KB

MD5
f6c1c7128bf4b4f41e155c40b2760e1c

SHA1
6f89a8242f4de43002a00e7e0e0088333b60ab95

SHA256
80f35710d8e1aee49170382d7e7ff48884363bcef668809543ed67c8f5bc052f

SHA512
0af82a5891f309fdeffbcf834afd30f91085c890200c115594776311b8cd5ed80b2580519200600d3586bbe42af916c51ee63deeb41655a8b2d4035f1c119e37

Download Submit
memory/2308-10-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/2328-0-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/2328-2-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/2328-8-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download