41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe
Size

101KB
MD5

1e59b7c74b224c79c2a2b422a91249b0
SHA1

d472634f3d75e9a96b9063ef345a2c278e3ce837
SHA256

41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7
SHA512

24bccc8b784f077b10258aa8b4aa84cc8480c8cd53f8b783608e43b5d1c30202728eb7fa4b3a46a7b26b76ae8acb837ad97798973d162b94dfcd904caf13edea
SSDEEP

1536:0GYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7yM:0fU/WF6QMauSuiWNi9CO+WARJrWNZsM

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2568	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1952	wuauclt.exe

Loads dropped DLL 1 IoCs

pid	Process
1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1952	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	28
PID 1612 wrote to memory of 1952	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	28
PID 1612 wrote to memory of 1952	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	28
PID 1612 wrote to memory of 1952	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	28
PID 1612 wrote to memory of 2568	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	29
PID 1612 wrote to memory of 2568	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	29
PID 1612 wrote to memory of 2568	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	29
PID 1612 wrote to memory of 2568	1612	41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1612
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\41179b92e5939c807b463cd528e38f2b50921d9f3abe594c54010c2f17ff34f7_NeikiAnalytics.exe" >> NUL
  2⤵
  - Deletes itself
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\wuauclt.exe

Filesize
101KB

MD5
44ba7c0a592340cf0803a867971d9267

SHA1
567533c6637e56f5f72becb465a013db1797f939

SHA256
1b55ee19428c9b4634436da003230cd777e1b96b59ef9fe06eb6cdbc3ed70684

SHA512
3512ef4eb89b23a77c4ce0cface1d2c0c5885d3186312a50076476875cd44833454015036f4a88051b3ea2fd323aa95dcd124032dd0e59983291f0d2fe9e1c5d

Download Submit
memory/1612-0-0x0000000000C60000-0x0000000000C7F000-memory.dmp

Filesize
124KB

Download
memory/1612-4-0x00000000000F0000-0x000000000010F000-memory.dmp

Filesize
124KB

Download
memory/1612-8-0x0000000000C60000-0x0000000000C7F000-memory.dmp

Filesize
124KB

Download
memory/1612-10-0x0000000000C60000-0x0000000000C7F000-memory.dmp

Filesize
124KB

Download
memory/1952-7-0x0000000001140000-0x000000000115F000-memory.dmp

Filesize
124KB

Download
memory/1952-9-0x0000000001140000-0x000000000115F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads