c743f0f8430040b928a18184de79607e86dc2990405e4690b5c1df3424acc0fc

General

Target

12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
Size

714KB
MD5

12779af97a788dd02ee7266c488c4950
SHA1

2acaf2c255ad35abee9fed348a163eceab1466fa
SHA256

c743f0f8430040b928a18184de79607e86dc2990405e4690b5c1df3424acc0fc
SHA512

648c0af406fbde065368c9aa724bd047a22e00fc00561a92a66f8bb2c744537e29409922e64d0328b08898037380d3ed63270a1ff4ee2847e8166eb2890b736b
SSDEEP

12288:phJ6OfBSTOYREk1gL5pRTcAkS/3hzN8qE43fm78VI:phJ6OfYTOYKB5jcAkSYqyEI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1712	MSWDM.EXE
344	MSWDM.EXE
2600	12779AF97A788DD02EE7266C488C4950_NEIKIANALYTICS.EXE
1180	Process not Found
2720	MSWDM.EXE

Loads dropped DLL 2 IoCs

pid	Process
1712	MSWDM.EXE
2700	Process not Found

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev1249.tmp	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1712	MSWDM.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 344	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	28
PID 1868 wrote to memory of 344	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	28
PID 1868 wrote to memory of 344	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	28
PID 1868 wrote to memory of 344	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	28
PID 1868 wrote to memory of 1712	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	29
PID 1868 wrote to memory of 1712	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	29
PID 1868 wrote to memory of 1712	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	29
PID 1868 wrote to memory of 1712	1868	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	29
PID 1712 wrote to memory of 2600	1712	MSWDM.EXE	30
PID 1712 wrote to memory of 2600	1712	MSWDM.EXE	30
PID 1712 wrote to memory of 2600	1712	MSWDM.EXE	30
PID 1712 wrote to memory of 2600	1712	MSWDM.EXE	30
PID 1712 wrote to memory of 2720	1712	MSWDM.EXE	32
PID 1712 wrote to memory of 2720	1712	MSWDM.EXE	32
PID 1712 wrote to memory of 2720	1712	MSWDM.EXE	32
PID 1712 wrote to memory of 2720	1712	MSWDM.EXE	32

C:\Users\Admin\AppData\Local\Temp\12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1868
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:344
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev1249.tmp!C:\Users\Admin\AppData\Local\Temp\12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\12779AF97A788DD02EE7266C488C4950_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:2600
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev1249.tmp!C:\Users\Admin\AppData\Local\Temp\12779AF97A788DD02EE7266C488C4950_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MSWDM.EXE

Filesize
256KB

MD5
27ecdec4859b6bff65961cb2a22e96cc

SHA1
8647723fda17d0e93e7b93fd85e85a604ecf1c54

SHA256
816444dc3f1ef302da88170c5a3b7e14060b26722ff01598563db3ea7f4491c8

SHA512
da177f54b51aea8bbaac9dcd594e5f03e23bf0cf961d8bb570cdc88a0b2c48bcecfe32fb7911776edddadd1178bc27eb1b036de979c2bebbf1d3a8c9a953f033

Download Submit
\Users\Admin\AppData\Local\Temp\12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads