00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe
Size

40KB
MD5

c7b2680f1976cf9dcb6fe6181991b400
SHA1

99c007b0658caecfe3e4b7ec12a20e507afb747b
SHA256

00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85
SHA512

6be5b92c6e73b1f5dee8d10fee0daa9bf232c6cd06b6ab322df7d0116dabdc0a6d9693e6d716ec89d4a37672ed8f3658e2a4ffb0e8edb6f32d2b87a7651974fd
SSDEEP

768:pdA4TOKjHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8tvCkA8SsBiaojlnXtZcc:nA4TljXRrs9sINeZEtejlIkoLN127BFA

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2516	update_Firefox.exe

Loads dropped DLL 4 IoCs

pid	Process
1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe
2516	update_Firefox.exe
2516	update_Firefox.exe
2516	update_Firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2516	1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe	28
PID 1508 wrote to memory of 2516	1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe	28
PID 1508 wrote to memory of 2516	1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe	28
PID 1508 wrote to memory of 2516	1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe	28
PID 1508 wrote to memory of 2516	1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe	28
PID 1508 wrote to memory of 2516	1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe	28
PID 1508 wrote to memory of 2516	1508	00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00ecc643276102457e927bc1e5ff3aea992697b3d3e189476684cd5f3a4c6f85_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe
  "C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\update_Firefox.exe

Filesize
41KB

MD5
3299fa99633a7d17bd86aef8f386cdc8

SHA1
bb145fe6844271189e242065150c0b53d6a24099

SHA256
9d1dbb3bda58f00da689556e2f3c454f87369a2194e078d7cc76c3861d72e907

SHA512
79e45bf7d49ecaf46e76c5d1dd6e8f783f03c87178bd3db99496bb528ef3cd1fd972634aec12797e5f776546ead2ec3f918d87058832c84ef2cf27db2af92d6e

Download Submit
memory/1508-1-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download