3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe
Size

134KB
MD5

c1e60035bb6bbea20f15409a69560390
SHA1

73b941d2f5a46e32d42a4c6141a185cbd3bd9e59
SHA256

3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64
SHA512

6e10bd08df4945e2a5a0b37ad9cad72328d27f6cb11d2c518e4c6d395ce2064b495a3b9970f355cd4aceb3d239c0186c9905eeb6b8274afc139db2c09ea06b17
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QW:riAyLN9aa+9U2rW1ip6pr2At7NZuQW

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2092	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0039000000016255-1.dat	upx
behavioral1/memory/2020-4-0x00000000000F0000-0x0000000000118000-memory.dmp	upx
behavioral1/memory/2020-3-0x0000000000260000-0x0000000000288000-memory.dmp	upx
behavioral1/memory/2092-7-0x00000000008F0000-0x0000000000918000-memory.dmp	upx
behavioral1/memory/2020-8-0x0000000000260000-0x0000000000288000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2092	2020	3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe	28
PID 2020 wrote to memory of 2092	2020	3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe	28
PID 2020 wrote to memory of 2092	2020	3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe	28
PID 2020 wrote to memory of 2092	2020	3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3284c9964378ff5d9d358c64911046e9b19d05476a0e97a2dc7cde39fcbf7c64_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
161b58c401b455c807d8f7c740a9bee1

SHA1
f3ba3e1c52d3ebd08b28d4d906600ef2dd65b370

SHA256
ffd5cc1c0686d6ba3f5fe6ee5fb4e27f2952ca90602276e5ce8d5c6bf1fa2068

SHA512
0ae1888d23dac8bf9face90e661c7c1fee3fffc6d5f43a5a18611e42644061b97f2564afc1b30f8b573d39ae040d3c389ab6a9a001e5062729c3760b826e22c2

Download Submit
memory/2020-4-0x00000000000F0000-0x0000000000118000-memory.dmp

Filesize
160KB

Download
memory/2020-3-0x0000000000260000-0x0000000000288000-memory.dmp

Filesize
160KB

Download
memory/2020-8-0x0000000000260000-0x0000000000288000-memory.dmp

Filesize
160KB

Download
memory/2092-7-0x00000000008F0000-0x0000000000918000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads