Overview

overview

10

Static

static

7

27574d1a4e...cs.exe

windows7-x64

10

27574d1a4e...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 04:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    27574d1a4e9c677b95f8fa8287007480_NeikiAnalytics.exe

  • Size

    114KB

  • MD5

    27574d1a4e9c677b95f8fa8287007480

  • SHA1

    b55f4fc8ec24ce7e50df98f8dac6719b37eeef8a

  • SHA256

    07b40675b4003bff65d795498f5dd78a7e17c2f2d16bebb066930312c3076310

  • SHA512

    eeba3cc04af091a88e982b32955fb20bb2cfca0ef9f1b5ec598258248538ca7dd570327879384d7503fbf7b64d8ce5b8bde1760427ea541dad0825bff1043e15

  • SSDEEP

    768:3x/5inm+cd5rHemPXKqUEphjVuvios1rPr4adL0NqlJMU6wiK1rEKlcIQ1TTGfo8:3xRsvcdCQjosnvnZ6grfQ1b4L

Score
10/10
upx

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    griptoloji
  • Password:
    741852

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27574d1a4e9c677b95f8fa8287007480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\27574d1a4e9c677b95f8fa8287007480_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Program Files (x86)\Java\jre-09\bin\jusched.exe
      "C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3964

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Java\jre-09\bin\jusched.exe
          Filesize

          114KB

          MD5

          27892b83763537716b2edf17cba50126

          SHA1

          2a2f577ffe3ca6d36157e76e53e884d1c6ba5c29

          SHA256

          3a3b1c085398c09b454254b0986f5f377aeef0c0a27d8f425271c99084d1a351

          SHA512

          f16c2227adf3a6f246185a3573f95cf988764df78d22242e0b5f38afc1315f463db5ef713c3436096d7eda196c81eff4e66086104046e0579ca7e1b50d5fd710

          Download Submit

        • memory/3964-12-0x0000000000400000-0x000000000044C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4212-0-0x0000000000400000-0x000000000044C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4212-10-0x0000000000400000-0x000000000044C000-memory.dmp

          Filesize

          304KB

          Download