74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f

General

Target
74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe
Size 894KB
Sample240622-bcferazapc
SHA256 74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f
MD5 1f1ac779ea84644cb1cc10aff0861830
SHA1 bb9bb825733f67a06fa9b62ad0dc5117cabd58e6
SHA512 5376340cb0d42b8f3441eff3d077587107253730edb79b35dff8b03266a68ba519599179f8e5d6d8c34bddb9f4858f838760c46c1e647cd891ddeeea1254573c
SSDEEP 12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TV:fqDEvCTbMWu7rQYlBQcBiT6rprG8aAV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{DF1C4125-014F-4040-A48C-155B12C70EC1}	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe
3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe
3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe
3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe
3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3164	3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe	90
PID 3948 wrote to memory of 3164	3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe	90
PID 3948 wrote to memory of 3952	3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe	92
PID 3948 wrote to memory of 3952	3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe	92
PID 3948 wrote to memory of 3460	3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe	93
PID 3948 wrote to memory of 3460	3948	74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe	93

C:\Users\Admin\AppData\Local\Temp\74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\74d3bdc4f691c660c9e6f4fb2971fd873d2e42e5acb097c6248977ca4000398f_NeikiAnalytics.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3772,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
1⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4948,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
1⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5300,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
1⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5480,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
1⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5496,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
1⤵
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5564,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
1⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5828,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6344,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
1⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6704,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
1⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=6696,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
1⤵
- Modifies registry class
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6568,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
1⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6100,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads