dae68625e9180c635f87365feb433b5dd8cd5e4ad54e79fe50bde5ec385bfba2

Analysis

max time kernel
79s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66e2bff83c33ed70c3d656a5c387f150_NeikiAnalytics.exe
Size 5.9MB
Sample240613-hlem5sscmk
SHA256 dae68625e9180c635f87365feb433b5dd8cd5e4ad54e79fe50bde5ec385bfba2
MD5 66e2bff83c33ed70c3d656a5c387f150
SHA1 8ede9ea95225b5473a43ee0ebc24252b738e8918
SHA512 32917f91c5ec06cbfbde1730bae48f32269730416a3f9692c5ec047163832ea0956af2457998460310ca647ff0cfedb0aa8650f1675ef330c6bb342b4a929128
SSDEEP 98304:jUG2OpAhwDfwoSdKJ4/xoxRMlEux696vGKpZMI2JlyzKI1ehI/e1cl+CtiLyTk7d:4G2OPZagRqeLlSKI1eh+e1cMCyyQ3GXY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2748	encrypted_loader.exe

Loads dropped DLL 2 IoCs

pid	Process
2748	encrypted_loader.exe
2748	encrypted_loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2748	4576	66e2bff83c33ed70c3d656a5c387f150_NeikiAnalytics.exe	81
PID 4576 wrote to memory of 2748	4576	66e2bff83c33ed70c3d656a5c387f150_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\66e2bff83c33ed70c3d656a5c387f150_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\66e2bff83c33ed70c3d656a5c387f150_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\onefile_4576_133627349562670381\encrypted_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\66e2bff83c33ed70c3d656a5c387f150_NeikiAnalytics.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

encrypted_loader.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_4576_133627349562670381\encrypted_loader.exe
Size 6.2MB
SHA256 a9ba9cd00f37177819a8406e7fea110ba7afb016585dd4f9f8779ba3151a6758
MD5 fea6c47aed34bee8c12303101a26e555
SHA1 2b70fa2c8de0df17756871488415e270f519b404
SHA512 b0192c28fbdd0eedb86ceee48df218e650d30c3ffe1c4d5cb57e49fb5b5170e35b7deaaec7dffc6e2ab41afd8df46df89dc45a7f481ef4b7ce2d4837d857f5b3
SSDEEP 98304:x4+OBV3YAnrDaeA5QOhQ/wOOlq+lp6KgqvE6:6V3fnrDaV3
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4576_133627349562670381\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4576_133627349562670381\vcruntime140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2748-18-0x00007FF746870000-0x00007FF746EA9000-memory.dmp

Download

memory/4576-27-0x00007FF7F5CE0000-0x00007FF7F62D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads