c743f0f8430040b928a18184de79607e86dc2990405e4690b5c1df3424acc0fc

Analysis

max time kernel
20s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
Size

714KB
MD5

12779af97a788dd02ee7266c488c4950
SHA1

2acaf2c255ad35abee9fed348a163eceab1466fa
SHA256

c743f0f8430040b928a18184de79607e86dc2990405e4690b5c1df3424acc0fc
SHA512

648c0af406fbde065368c9aa724bd047a22e00fc00561a92a66f8bb2c744537e29409922e64d0328b08898037380d3ed63270a1ff4ee2847e8166eb2890b736b
SSDEEP

12288:phJ6OfBSTOYREk1gL5pRTcAkS/3hzN8qE43fm78VI:phJ6OfYTOYKB5jcAkSYqyEI

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2016	MSWDM.EXE
1208	MSWDM.EXE
1452	12779AF97A788DD02EE7266C488C4950_NEIKIANALYTICS.EXE
4596	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev518B.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev518B.tmp	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1208	MSWDM.EXE
1208	MSWDM.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2016	2636	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	81
PID 2636 wrote to memory of 2016	2636	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	81
PID 2636 wrote to memory of 2016	2636	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	81
PID 2636 wrote to memory of 1208	2636	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	82
PID 2636 wrote to memory of 1208	2636	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	82
PID 2636 wrote to memory of 1208	2636	12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe	82
PID 1208 wrote to memory of 1452	1208	MSWDM.EXE	83
PID 1208 wrote to memory of 1452	1208	MSWDM.EXE	83
PID 1208 wrote to memory of 4596	1208	MSWDM.EXE	85
PID 1208 wrote to memory of 4596	1208	MSWDM.EXE	85
PID 1208 wrote to memory of 4596	1208	MSWDM.EXE	85

C:\Users\Admin\AppData\Local\Temp\12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2636
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2016
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev518B.tmp!C:\Users\Admin\AppData\Local\Temp\12779af97a788dd02ee7266c488c4950_NeikiAnalytics.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\12779AF97A788DD02EE7266C488C4950_NEIKIANALYTICS.EXE
    3⤵
    - Executes dropped EXE
    PID:1452
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev518B.tmp!C:\Users\Admin\AppData\Local\Temp\12779AF97A788DD02EE7266C488C4950_NEIKIANALYTICS.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\12779AF97A788DD02EE7266C488C4950_NEIKIANALYTICS.EXE

Filesize
714KB

MD5
a55ed9f443aa930427b94a6c87111a2d

SHA1
e3e30e7b5f0a235ac788e74ed119967f54e60cd3

SHA256
fe5a3ba4a3f6c2b301a3ecacfe8509a5c25c501610c049cfc577039ef4338feb

SHA512
d5f1bbd989ca806b260a3688a0ed7a8b520f6081280d66a742f12f114ef1ef423a0ae18b83530c7d3250f195e611ba1595ed96c7315345c4a9d8516d708d7fdf

Download Submit
C:\Windows\MSWDM.EXE

Filesize
256KB

MD5
27ecdec4859b6bff65961cb2a22e96cc

SHA1
8647723fda17d0e93e7b93fd85e85a604ecf1c54

SHA256
816444dc3f1ef302da88170c5a3b7e14060b26722ff01598563db3ea7f4491c8

SHA512
da177f54b51aea8bbaac9dcd594e5f03e23bf0cf961d8bb570cdc88a0b2c48bcecfe32fb7911776edddadd1178bc27eb1b036de979c2bebbf1d3a8c9a953f033

Download Submit
C:\Windows\dev518B.tmp

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit