Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 22:08

General

  • Target

    1d1fdc03f7da06e88ba7df90607b6490_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    1d1fdc03f7da06e88ba7df90607b6490

  • SHA1

    6421ab245316df9236e3792d3ba82935c4a6ef97

  • SHA256

    e5e29ac2651555ee04748022ca2493400b9507476bfbfd89ab02b20619ed4c5f

  • SHA512

    5f89e54227b5e5547661a8ceef80284822054aecbc7f9ed7ad68f97e106d02d91f6ca0b77517d95bff0a7c349313cc6631e0d44a0e04450c497c8992f716df10

  • SSDEEP

    1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Q/:riAyLN9aa+9U2rW1ip6pr2At7NZuQ/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d1fdc03f7da06e88ba7df90607b6490_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1d1fdc03f7da06e88ba7df90607b6490_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:3168

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Update\WwanSvc.exe

          Filesize

          134KB

          MD5

          f26fee28d4f2a345d2eab596c6bea04a

          SHA1

          05bbaa8659743f340ff2a1c37e304315debd90de

          SHA256

          508bcbe0760f15cbe2b7c9ac1af10f9ebd3661de6a4366aeae68bb201e2993f3

          SHA512

          037b0cdb20ae5a8292510391ecd0714744671066b94fbd4d6f8ddc7562f15f89196486dbf3eaa786ad8c902ca1d81aa379f0febadfec35a99a561ba419070bd8

        • memory/2620-0-0x0000000000E80000-0x0000000000EA8000-memory.dmp

          Filesize

          160KB

        • memory/2620-5-0x0000000000E80000-0x0000000000EA8000-memory.dmp

          Filesize

          160KB

        • memory/3168-6-0x00000000001C0000-0x00000000001E8000-memory.dmp

          Filesize

          160KB