Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 16:09

General

  • Target

    6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe

  • Size

    41KB

  • MD5

    6ae1dcf9bb992a43bde386cc50307480

  • SHA1

    2dd9d531eeb9ae708c03f329010a914feeeb35f7

  • SHA256

    48c778d11922adc7f82f7a475e5036e0acffd4667623d7113cd45bd81760a595

  • SHA512

    6470327f72a07d633699e0b42c828bae5b6315bfcacb307c754f796dcb6334e8b7e6111b784c845ed2c0af747c1c45b8065c7feb8d04720590e4b891d320e4f6

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4128
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3428

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search[1].htm

            Filesize

            25B

            MD5

            8ba61a16b71609a08bfa35bc213fce49

            SHA1

            8374dddcc6b2ede14b0ea00a5870a11b57ced33f

            SHA256

            6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

            SHA512

            5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

          • C:\Users\Admin\AppData\Local\Temp\tmpF0F1.tmp

            Filesize

            41KB

            MD5

            e91f1f0fa8d262ca80359d7d2a24baec

            SHA1

            4c42d180b9df5ac0465af71463cb557b485bf3aa

            SHA256

            4499c8943413aa87aff806c01abaef32263af20a687e475ec01f2081169d7f6d

            SHA512

            26718a492cfd6b2e44bed27c7d44e18f590eea9cd200122d42ecf27b7ed076f2220fca2c80ee1132a5666857705849e0a6418f5b5a63cc161d38a70d09e3e167

          • C:\Users\Admin\AppData\Local\Temp\zincite.log

            Filesize

            160B

            MD5

            3ba5f6f49b0e92cc77ee5ef20891a86f

            SHA1

            8e9413f903f9cee6a5d3948eec2ed398e0570f96

            SHA256

            4ac5425c4b6c298b8980c8bb72f361bdafe730d06125a2131634d45adcd0ecad

            SHA512

            6e1d0b600573a6eb5ab20d0b043d24d8083b144aa20c4319f01c5983607f16165122586fe677c914efde5ee78bc8fcd55ec67f264cb21954399dd5d683a82586

          • C:\Windows\services.exe

            Filesize

            8KB

            MD5

            b0fe74719b1b647e2056641931907f4a

            SHA1

            e858c206d2d1542a79936cb00d85da853bfc95e2

            SHA256

            bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

            SHA512

            9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

          • memory/2356-56-0x0000000000500000-0x0000000000510200-memory.dmp

            Filesize

            64KB

          • memory/2356-13-0x0000000000500000-0x0000000000510200-memory.dmp

            Filesize

            64KB

          • memory/2356-117-0x0000000000500000-0x0000000000510200-memory.dmp

            Filesize

            64KB

          • memory/2356-0-0x0000000000500000-0x0000000000510200-memory.dmp

            Filesize

            64KB

          • memory/2356-61-0x0000000000500000-0x0000000000510200-memory.dmp

            Filesize

            64KB

          • memory/4128-19-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-57-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-43-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-48-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-50-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-55-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-36-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-38-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-31-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-26-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-24-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-116-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-14-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-5-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB

          • memory/4128-170-0x0000000000400000-0x0000000000408000-memory.dmp

            Filesize

            32KB