5a586d5b020a5b3cb5c10f644de397d95074f429aee31c33a1aa6468e0a6a3dc

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 01:51

Target

23315eeff1aaaa973cee3ce590e910f0_NeikiAnalytics.exe
Size

3.3MB
MD5

23315eeff1aaaa973cee3ce590e910f0
SHA1

4568615611c0b014136085b8da7b4addc9dd8cdc
SHA256

5a586d5b020a5b3cb5c10f644de397d95074f429aee31c33a1aa6468e0a6a3dc
SHA512

e246d2fe2bb16539e51b5e1f489bfc8dc3a7a5028d8ca4c026264409906252d479ebbb5a12340ac15993cdeb4fa08f0ba30a39e2bf0daf7d7f1d98467823172c
SSDEEP

98304:exPK8OZZRkfMOYl0u9oUoOe+2ER6mVhPL:exPK828lXuWUDe+xVhT

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2884	23315eeff1aaaa973cee3ce590e910f0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\23315eeff1aaaa973cee3ce590e910f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\23315eeff1aaaa973cee3ce590e910f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2884

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2884-0-0x000000013FC20000-0x0000000140BE4000-memory.dmp

Filesize
15.8MB

Download
memory/2884-1-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2884-2-0x000000013FC20000-0x0000000140BE4000-memory.dmp

Filesize
15.8MB

Download
memory/2884-4-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download