Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 13:39
Behavioral task
behavioral1
Sample
80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe
-
Size
134KB
-
MD5
80d7e57ccbb67e471aa23adfe83e2850
-
SHA1
39009576035ec24e9eee434af30382e2d59862a4
-
SHA256
a3bacd6514b7045a1541a8d53c5846b568827fe7165e7bbc15c573dd6a7dc535
-
SHA512
9389f11518fccdcb6819921cea0e68c083b101e754f379180e3d92619516f0dabb8c2c862655a9028176f85973e2e64e0a8e29378bdaef2f121f746954a82461
-
SSDEEP
1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qy:riAyLN9aa+9U2rW1ip6pr2At7NZuQy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WwanSvc.exepid process 1532 WwanSvc.exe -
Loads dropped DLL 1 IoCs
Processes:
80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exepid process 2984 80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2984-0-0x0000000000FC0000-0x0000000000FE8000-memory.dmp upx behavioral1/memory/2984-4-0x0000000000140000-0x0000000000168000-memory.dmp upx \ProgramData\Update\WwanSvc.exe upx behavioral1/memory/2984-7-0x0000000000FC0000-0x0000000000FE8000-memory.dmp upx behavioral1/memory/1532-8-0x0000000001010000-0x0000000001038000-memory.dmp upx behavioral1/memory/2984-9-0x0000000000FC0000-0x0000000000FE8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run" 80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exedescription pid process target process PID 2984 wrote to memory of 1532 2984 80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe WwanSvc.exe PID 2984 wrote to memory of 1532 2984 80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe WwanSvc.exe PID 2984 wrote to memory of 1532 2984 80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe WwanSvc.exe PID 2984 wrote to memory of 1532 2984 80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe WwanSvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\80d7e57ccbb67e471aa23adfe83e2850_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\ProgramData\Update\WwanSvc.exe"C:\ProgramData\Update\WwanSvc.exe" /run2⤵
- Executes dropped EXE
PID:1532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\Update\WwanSvc.exeFilesize
134KB
MD53a4135954e2a8d54b4201d5551b13d36
SHA1aa0be77e07d652226773a286b205c0e10c82219f
SHA25609d71a186d86f946403117801466f96f847562ca3a8551709b4ba882127d112b
SHA512bf84f1c998ddbde046d24afe4e61affb9bfcabc8ef78843d472beb123f7ce98691dde9d4d43d6ac3e227b9c152bd4c7aae8a90e4f4569fdd110e5c24fb14948f
-
memory/1532-8-0x0000000001010000-0x0000000001038000-memory.dmpFilesize
160KB
-
memory/2984-0-0x0000000000FC0000-0x0000000000FE8000-memory.dmpFilesize
160KB
-
memory/2984-4-0x0000000000140000-0x0000000000168000-memory.dmpFilesize
160KB
-
memory/2984-7-0x0000000000FC0000-0x0000000000FE8000-memory.dmpFilesize
160KB
-
memory/2984-9-0x0000000000FC0000-0x0000000000FE8000-memory.dmpFilesize
160KB