Analysis

  • max time kernel
    126s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 08:29

General

  • Target

    6cddac7f0da3ccd61187eb851c11d6c0_NeikiAnalytics.exe

  • Size

    47KB

  • MD5

    6cddac7f0da3ccd61187eb851c11d6c0

  • SHA1

    bd544836d7fa766f037bcfd9a8b75b74ba000c2d

  • SHA256

    a445c4380acd2da0d87781a281f113015e25e4a2a5e197a72117a89df3221565

  • SHA512

    663fd1a5faa4f9216a85710e72436be4f622f542b0fbf3f7b87a2913c983a6d5f047991a05299f6dee8da38ca3b98a16f3baae47cb596606156aef7de9cd7be7

  • SSDEEP

    768:n8eRH+MlFh0pXrL4i6sh7iQroCHmmbk2S:n9l+Gi6sh7iQroCLS

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6cddac7f0da3ccd61187eb851c11d6c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6cddac7f0da3ccd61187eb851c11d6c0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
      "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2f72bb5f1be517f08518c6a91a0bf282

    SHA1

    9f73f72a63b9560db2f70abbf457718df2281934

    SHA256

    58d5b3e4b38c2407d6808c08be4aa5cca4a77a66797bdef3a84efc8287f611f3

    SHA512

    d5c67e69011f27819a61f37490ddc60bd41f80d578eb385957db2bb43bffbe12fefd473fae18bd5f5c38e717691e093a6b9b4a79b0c3184435d77769cc017ecf

  • C:\Users\Admin\AppData\Local\Temp\CabA41E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarA4CC.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\bkgrnd.exe

    Filesize

    48KB

    MD5

    7a65604f9e8529bb2e9f48c405ff227c

    SHA1

    52332da1c9590f76b1540ddba43dbfec79bf7e59

    SHA256

    0e25c2fdbc8c8789c90d47bf158b2209b98a1a874844c684c40f780e18a0df74

    SHA512

    4fa66c4cb6a3ddd6eefd59db40d930a8adc3270cda9a06424a484f275f26a4695ecbfa2172a585091b17ceb0109d5024cd49017e4b86153a29609ed18a2facb7

  • memory/2156-168-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2916-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2916-1-0x0000000004000000-0x0000000004006000-memory.dmp

    Filesize

    24KB

  • memory/2916-2-0x0000000004000000-0x0000000004006000-memory.dmp

    Filesize

    24KB

  • memory/2916-9-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB