c02d7d9f075038ebf1792921bda49dc19103992bce0689e852a58d06182455a7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe
Size

398KB
MD5

7f85e92cb08a30d70b9ae10b9ad00f20
SHA1

4bc73402c1a57042f12fdff7db4923fa3182e7aa
SHA256

c02d7d9f075038ebf1792921bda49dc19103992bce0689e852a58d06182455a7
SHA512

d74fd5f67e7596893a0d0fb4dedf078590fa906f44627d86fb9e17437f52cec42ea866d6b4a95a93adf16b6ed3882f55d7efddd67cdd0bcdc6db32b200e26d62
SSDEEP

6144:u5xXylrltwTBnv3AX2jtBzmMZst2jKmU7UDGsGRlJ44zT3Al8Kmwm3KqR:a42Tlv3XKMZst0HUIIJa8K2R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2968	INSTALL.EXE

Loads dropped DLL 1 IoCs

pid	Process
2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2968	2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2968	2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2968	2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2968	2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2968	2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2968	2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2968	2148	7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7f85e92cb08a30d70b9ae10b9ad00f20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\WD_CCD.tmp\INSTALL.EXE
  "C:\Users\Admin\AppData\Local\Temp\WD_CCD.tmp\INSTALL.EXE"
  2⤵
  - Executes dropped EXE
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WD_CCD.tmp\INSTALL.INI

Filesize
318B

MD5
da36c911e35fa55aedfd056e50398793

SHA1
9877516d20c282aa201c864750b4a1f692b11d17

SHA256
f4bc6ec95513b2a40a4e92945e60b2a5cbcf7386c6075c1d3dcf9e118312fcc5

SHA512
43b23cc95d7ff166412a1c82f888e3dd486cc83d8b1d2aed8b01aa01730cacd8af693466b173e797a1d8121b9616bc5a7ad6a45bef32a7b107e482d8673b734a

Download Submit
\Users\Admin\AppData\Local\Temp\WD_CCD.tmp\INSTALL.EXE

Filesize
424KB

MD5
ab0d94ee38e2b2038771c7d0e38f2c28

SHA1
481c45787a50f42336605c811e1e417677fb535c

SHA256
d3dc60ad5431d3f21a1b0c986356b20556d258ab8c004a3dba6ec99102b78779

SHA512
100ae206fa086ce79cf8330ed9d1aac8036f5d9c45c90cfb86737ed229db935558df82997b1b7255bdb5c67709b03676b3e94384a5024524ab8b53696742d51a

Download Submit