7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe
Size

450KB
MD5

0a3790c783a0f790a37d4da2feb02680
SHA1

a5411234c324fb01012277d5cf81dbdcedcf106d
SHA256

7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042
SHA512

5ddba731256c20a106fe1a91216ffa5982421c3860ad5e22aab4d1358a6d19182b3b97735ca949f8dd58e803b04365b1f2bdc03b8c1ae940db9c20359033815b
SSDEEP

12288:NJu6lfyi4fabr9jy4BNKOSuDVh+vh4tH1jo3rqsh2h:N8XfyhLNKQVhKutH1jo3PhA

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2248	teoghah.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000235fc-4.dat	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\teoghah.exe	7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe
File created	C:\PROGRA~3\Mozilla\nvzdrxb.dll	teoghah.exe

C:\Users\Admin\AppData\Local\Temp\7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7364939f602a5716e21c1c2758808113ffbfa4e143d3901b90442ca18f898042_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2988

C:\PROGRA~3\Mozilla\teoghah.exe
C:\PROGRA~3\Mozilla\teoghah.exe -cjiekkn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4188,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\teoghah.exe

Filesize
450KB

MD5
b72b23439325619819b4d367409cd628

SHA1
9b81f8d4e09e0914653a62ae1d32e54f0242d2c1

SHA256
970f66c02d1e26689146405caa0dcaf0b7dde940cd9bda56468cb560774aa789

SHA512
36d45db30cb81b1eab0d41573375726aa97d621463a0e3be63fcd5d7201bf2d4333d3246d7055581a898cd489904c0522c2e2cb39b9af14468d26315d359f39d

Download Submit
memory/2248-6-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2248-8-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2248-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2248-13-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2988-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2988-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2988-1-0x0000000000710000-0x000000000076B000-memory.dmp

Filesize
364KB

Download
memory/2988-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download