Analysis
-
max time kernel
28s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 00:09
Static task
static1
Behavioral task
behavioral1
Sample
4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe
-
Size
615KB
-
MD5
4ee941525ef3445b099653dce246bbc0
-
SHA1
02d803d30642832034ccd9bc858f3fd99e5ba0e4
-
SHA256
8fc73a320967934f254b8dc63aa7cd65b9e9aed62bbe48ec838914e82fdb142d
-
SHA512
d291089751dccf3952465e3eedd9eed79b52fab5b46a82d5c604baa5784f47d3106a17e374e3357506ecc75dd7f6dcc56587c2584429cf48541ad4eeef8fb3eb
-
SSDEEP
12288:wlbX+Waplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX50:WbX+NYTqMi8CtBd2QHCHmTBW50
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4288 MSWDM.EXE 2348 MSWDM.EXE 3156 4EE941525EF3445B099653DCE246BBC0_NEIKIANALYTICS.EXE 2700 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe File opened for modification C:\Windows\dev3393.tmp 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe File opened for modification C:\Windows\dev3393.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2348 MSWDM.EXE 2348 MSWDM.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 688 wrote to memory of 4288 688 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe 81 PID 688 wrote to memory of 4288 688 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe 81 PID 688 wrote to memory of 4288 688 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe 81 PID 688 wrote to memory of 2348 688 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe 82 PID 688 wrote to memory of 2348 688 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe 82 PID 688 wrote to memory of 2348 688 4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe 82 PID 2348 wrote to memory of 3156 2348 MSWDM.EXE 83 PID 2348 wrote to memory of 3156 2348 MSWDM.EXE 83 PID 2348 wrote to memory of 2700 2348 MSWDM.EXE 87 PID 2348 wrote to memory of 2700 2348 MSWDM.EXE 87 PID 2348 wrote to memory of 2700 2348 MSWDM.EXE 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:688 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4288
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev3393.tmp!C:\Users\Admin\AppData\Local\Temp\4ee941525ef3445b099653dce246bbc0_NeikiAnalytics.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4EE941525EF3445B099653DCE246BBC0_NEIKIANALYTICS.EXE
- Executes dropped EXE
PID:3156
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev3393.tmp!C:\Users\Admin\AppData\Local\Temp\4EE941525EF3445B099653DCE246BBC0_NEIKIANALYTICS.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2700
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5fc01183e9c63369bdb4c3ff49d8a382d
SHA17174b9da8cf755e39a615996c57697cd0c0e9f4e
SHA2560bdb8a22296b7c63ecd6654dce7c112b02ce0aa1a25b2b8bad4299191e735b29
SHA512041378d8393fc00d4f93cd3b465df0f919721f20b527ddc6911e6ea263219cfa97b3d1749b4fe4cb09089d6d3caa09a22a693566f8a353963ff8b5d15a484163
-
Filesize
47KB
MD5336ffd74e5eb29bc13e4e0f5de0cb57a
SHA1fb3bab77482267f8880cd329d926a41d397d072d
SHA256688c0c407e9651d4fb63017475f3ca304c7ff8c0185592c3a1d7d3b660098c79
SHA512e8e70882eebbb5a602ac68a4a51a15c7d32d083b5c5717981a9b33d358e17411a0fee1294b631f29f0f5cf06e0ad86109198de6114ba364fdaac1e866a049d76
-
Filesize
568KB
MD504fb3ae7f05c8bc333125972ba907398
SHA1df22612647e9404a515d48ebad490349685250de
SHA2562fb898bacb587f2484c9c4aa6da2729079d93d1f923a017bb84beef87bf74fef
SHA51294c164a0b884c939ece30f5038d07b756702998d46786f9f613fbea2eb30bed4bc19a409f347bb4cc565898473b18155d580b453683223beaf30ed4079c251b2