Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 21:06

General

  • Target

    870b8a16f42a9f4d218587d4dfc32fb0_NeikiAnalytics.exe

  • Size

    32KB

  • MD5

    870b8a16f42a9f4d218587d4dfc32fb0

  • SHA1

    d5437bbeac267f484e86a36cf8a7d5b86c6e7a85

  • SHA256

    48df2246ab2dcb5542e9c34d11d46b83273748dc6e7e7e8099ef4e4363896fcc

  • SHA512

    7c795225c65091a69fc04e77a566951132cd76142ad03b41122e7750324212542888c2317f57637a3459f7972d0abee174593eb7fe4c12c9a765a0cfe50b6023

  • SSDEEP

    192:KlApk98m4e0/IDJh/5ZQcvoyne4t/PQ3Pw1C0SluWbiWBNEckcVhJriEYHfIc:MApc8m4e0GvQak4JI341C0abnk6hJPSZ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\870b8a16f42a9f4d218587d4dfc32fb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\870b8a16f42a9f4d218587d4dfc32fb0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\windows\SysWOW64\sal.exe
      "C:\windows\system32\sal.exe"
      2⤵
      • Executes dropped EXE
      PID:1184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\sal.exe

    Filesize

    32KB

    MD5

    6e55bab880205ea7b515231b40a45d37

    SHA1

    9210604f17447d71268bbd790caee8422473487a

    SHA256

    0b8f357b2d94b3f572d9642ea8de70925be33879da1b73aa0a0353fd5f753703

    SHA512

    cc032572f4d5fc5e5acba8a79c918d2ee503bd3474b634a7611df2582d77960aeb35f6dfdb84b4bd1cf84012bc522ff160a8a3bf2ff6202f858944eb300546a6

  • memory/1184-13-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2352-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2352-4-0x0000000000300000-0x0000000000309000-memory.dmp

    Filesize

    36KB

  • memory/2352-11-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB