8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea_NeikiAnalytics.exe
Size

590KB
MD5

d40a93505b9a89e1d7350d9ea73a80b0
SHA1

b8af2d0dd44b8529f9974f76981c152caaf3acce
SHA256

8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea
SHA512

5f1e20ede09eddd2d7a676a4098d258212ea1b3fa6f2bebaad2ff227e72ceefe7a3a277f0039d282f4b9b470f56efb3eae993b6e46a92de1fc48d3bfa8846802
SSDEEP

3072:Nw5rSWAkQfza8JvIoPvSIe6oy/uPy3mm0RiEBoQ:N/WYRJvnCPWQmJEBoQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1244	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\LwnQUlqB.dll	8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea_NeikiAnalytics.exe
File created	C:\Windows\fVrmWrVv.dll	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
File created	C:\Windows\BpBmoM\tsSmHD.dll	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
File opened for modification	C:\Windows\BpBmoM\tsSmHD.dll	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1244	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
1244	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
1244	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
1244	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
1244	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
1244	8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1244	2544	8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea_NeikiAnalytics.exe	82
PID 2544 wrote to memory of 1244	2544	8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea_NeikiAnalytics.exe	82
PID 2544 wrote to memory of 1244	2544	8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8e10c7cda09a5996d53aedbd82398ea268a5c92ea971f0c9053b0d38a11a5bea_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2544
- C:\ProgramData\YPHhmmk\8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe
  "C:\ProgramData\YPHhmmk\8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\YPHhmmk\8e10c7cda09a5996d53aedbd82398ea268a5c92ea71f0c9053b0d38a11a5bea_NeikiAnalytics.exe

Filesize
597KB

MD5
f59196991ca33780c1d7e0c35f44de7e

SHA1
bff3140b346a7112183d453d44feb5d8cf5c0d28

SHA256
9b61e5d1ed20a8d56f3f35a96589366177215d89cbe601a8831e9dec20d6abd7

SHA512
5111c900bcee716962557aa84615323e7e305acb30e1178bc5e6e9b0908181cfcb915ed869a862324855397b802d61a1476fb0c3c9f360a5cae8166ea0253b39

Download Submit
memory/1244-19-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-18-0x0000000000550000-0x0000000000553000-memory.dmp

Filesize
12KB

Download
memory/1244-34-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-11-0x0000000000550000-0x0000000000553000-memory.dmp

Filesize
12KB

Download
memory/1244-10-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-15-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-16-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-33-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-32-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-20-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1244-21-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2544-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2544-1-0x0000000002080000-0x0000000002083000-memory.dmp

Filesize
12KB

Download
memory/2544-12-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download