7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe
Size

450KB
MD5

0a3790c783a0f790a37d4da2feb02680
SHA1

a5411234c324fb01012277d5cf81dbdcedcf106d
SHA256

7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042
SHA512

5ddba731256c20a106fe1a91216ffa5982421c3860ad5e22aab4d1358a6d19182b3b97735ca949f8dd58e803b04365b1f2bdc03b8c1ae940db9c20359033815b
SSDEEP

12288:NJu6lfyi4fabr9jy4BNKOSuDVh+vh4tH1jo3rqsh2h:N8XfyhLNKQVhKutH1jo3PhA

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2316	eccstpf.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral1/files/0x003100000001313a-5.dat	upx
behavioral1/memory/2316-7-0x0000000000400000-0x000000000045F000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\eccstpf.exe	7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe
File created	C:\PROGRA~3\Mozilla\qtlrtjl.dll	eccstpf.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2236	7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe
2316	eccstpf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2316	1980	taskeng.exe	29
PID 1980 wrote to memory of 2316	1980	taskeng.exe	29
PID 1980 wrote to memory of 2316	1980	taskeng.exe	29
PID 1980 wrote to memory of 2316	1980	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2236

C:\Windows\system32\taskeng.exe
taskeng.exe {721DFBAA-6DD8-4367-A6FD-4C828C65D86D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\PROGRA~3\Mozilla\eccstpf.exe
  C:\PROGRA~3\Mozilla\eccstpf.exe -ufgsyxd
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\eccstpf.exe

Filesize
450KB

MD5
0009a973194eb20129a30aca380dafb4

SHA1
2dd03eed72aa479b0884e88d1b7ae657f40c721d

SHA256
2915fd9e7762e593ba3ca10eb2a31c08ffb6512b117522a9e9bba4157c572bf1

SHA512
48ff148426cc51d8f377eed1f1ba49a828527955f56406304b3465633967b37d1d8e2fe66a1512c972efea090866969969772e0395ee132fba55317b8f5ee851

Download Submit
memory/2236-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2236-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2236-1-0x0000000000260000-0x00000000002BB000-memory.dmp

Filesize
364KB

Download
memory/2236-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2316-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2316-8-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2316-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2316-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download