0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe
Size

66KB
MD5

ff36c7f7a6175f22c58b18607f5f14e0
SHA1

5598d50faf1093e8f83d09055576a45f2e79c81e
SHA256

0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995
SHA512

78f6d284bb66ddd57d2774144f8c258baf6a01d2c5ff2ef4ceabdd178bc67e512e8396821945244fe5985ff2834e650ef36334b49e195b9f44117ad367954bca
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsi4Q:BbdDmjr+OtEvwDpjM8i

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2968	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2968	2364	0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2968	2364	0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2968	2364	0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2968	2364	0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d1fc25a00af2f8f8c2645797029f5432ebc65adedc368c69fa74cbc227dc995_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
66KB

MD5
7ad3e84e1c5cf112f8e817852490f989

SHA1
604e8c6927beabe973c72fe8a2a2f5bb1a2cb907

SHA256
9a6a7ccd179b6660b8f7d90667a458bfceb78650d77d3efcd52e763bb2d71081

SHA512
6ec6616ada903c8fe783a71d6e58b464d0848894df38682180b80ddbf1744e6dadfebfb531ff6d8fb0bdf426e75d8fdd2e171284f507f6cb7d5c5a883704acec

Download Submit
memory/2364-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2364-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2364-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2364-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2364-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2968-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2968-19-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2968-26-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2968-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download