6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab

Analysis

max time kernel
146s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab_NeikiAnalytics.exe
Size

134KB
MD5

49950e3bac9958afa7b59a7404cc2720
SHA1

6dc719b7817694b2720e62c77f419e097c9e4b6f
SHA256

6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab
SHA512

25cc817262d13c60a342ba79181fe24de01ab681b93e170cd93de0b1c0677a2e822e99d666931f92e0837f35bff31a0f35ee3bb6d6085271070c1036e48d3e05
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qg:riAyLN9aa+9U2rW1ip6pr2At7NZuQg

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2408	WwanSvc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3416-0-0x0000000000100000-0x0000000000128000-memory.dmp	upx
behavioral2/memory/3416-4-0x0000000000100000-0x0000000000128000-memory.dmp	upx
behavioral2/files/0x0008000000023409-3.dat	upx
behavioral2/memory/2408-6-0x0000000000BD0000-0x0000000000BF8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2408	3416	6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab_NeikiAnalytics.exe	81
PID 3416 wrote to memory of 2408	3416	6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab_NeikiAnalytics.exe	81
PID 3416 wrote to memory of 2408	3416	6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6864275b455c290c0c078a6a7ece5e297ca90884e99d6b442ade2d0c5ed193ab_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3416
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
e524189811de05507195cd1c7d4f4b87

SHA1
58208b882e53bd3dc6b556342fc240572c13443c

SHA256
4877fea9ee697a2d1a1ac2829fbe708215c9e68b2e3b0cf68b3417779fa6efb8

SHA512
f660c793ea3b2da5be94ec5664a757abc9355b62e9b17736a2a2a640b28f2dc94b0d8ac3afead6f33c51639685d069d99a13dbed08e82771b8b4e3e3199971ad

Download Submit
memory/2408-6-0x0000000000BD0000-0x0000000000BF8000-memory.dmp

Filesize
160KB

Download
memory/3416-0-0x0000000000100000-0x0000000000128000-memory.dmp

Filesize
160KB

Download
memory/3416-4-0x0000000000100000-0x0000000000128000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads