Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 08:12
Behavioral task
behavioral1
Sample
e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe
-
Size
13KB
-
MD5
e34ed89299b21df8903a367f30058450
-
SHA1
f94c7c3f0f05289a93e247047c64511254227b27
-
SHA256
ab6098c3001f397b2cc5f934985d2e4f4e41ae1e553b4b219d6c56cc25a86f46
-
SHA512
2857b3d21bebf4d824a2c8ef6a83dfeb42919e6d2a3c171f2010500b5b0ed534d4b479e682bdc13850984a4431b4083deee03788aa4168e270a68b2eae114aa3
-
SSDEEP
192:pjUWFh4fvYGIQnsA6psQ56uFaNJhLkwcud2DH9VwGfctQEAC5Es9Gsj5Efx8X5d5:5KE7pD/aNJawcudoD7U55Es9GsGyB
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2604 trys.exe -
Loads dropped DLL 5 IoCs
pid Process 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/1044-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b000000014af6-25.dat upx behavioral1/memory/1044-26-0x0000000000860000-0x000000000086B000-memory.dmp upx behavioral1/memory/1044-47-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2604-48-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe Token: SeDebugPrivilege 2604 trys.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 2604 trys.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3068 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 28 PID 1044 wrote to memory of 3068 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 28 PID 1044 wrote to memory of 3068 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 28 PID 1044 wrote to memory of 3068 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 28 PID 3068 wrote to memory of 2552 3068 cmd.exe 30 PID 3068 wrote to memory of 2552 3068 cmd.exe 30 PID 3068 wrote to memory of 2552 3068 cmd.exe 30 PID 3068 wrote to memory of 2552 3068 cmd.exe 30 PID 1044 wrote to memory of 2604 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 31 PID 1044 wrote to memory of 2604 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 31 PID 1044 wrote to memory of 2604 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 31 PID 1044 wrote to memory of 2604 1044 e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e34ed89299b21df8903a367f30058450_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JMYCH.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f3⤵
- Adds Run key to start application
PID:2552
-
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD56dbb2090ff90500da05a027765cde190
SHA1425b833d9d1df8d6df6e5a59f738058808271949
SHA25671ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881
SHA5127e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3
-
Filesize
13KB
MD5ad35ff3026fdba7cfc9353c700701ea9
SHA12081d7d9ab46b35c5c0aa512e3f5de42bac6ccfe
SHA256adbaf72b8e4972b0ee1916532a75398edaa4b0df6f8616e9615a3027d88854e5
SHA5124283a2665bfb8092c8ebc5f678f76fbfa0fa6e74ae6d3b0f5896e2f4c79f980935042691a6cd636ca4cc4c229293b9fc04b66963aaaff8d8ccded3654086805f