0aa6cd26f2a6e7aef4b8946a0158bba57f5f4cfab5691ea7ac3f1dd4371e84db

Analysis

max time kernel
134s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0aa6cd26f2a6e7aef4b8946a0158bba57f5f4cfab5691ea7ac3f1dd4371e84db_NeikiAnalytics.dll
Size

76KB
MD5

fad714960e7736c465d9f7a67bb53f70
SHA1

25d1fd76b2d344b3be185c4df697870c24b268e4
SHA256

0aa6cd26f2a6e7aef4b8946a0158bba57f5f4cfab5691ea7ac3f1dd4371e84db
SHA512

9883f3c188cba3e10b195f7e3207cfe2c202a111897aff27c0b12d1b5b7f7d01358b650c27e2ded50a433d3dbd3b4a32fb40b4e8acd66e8d49caadb59691ad97
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZcuuL3:c8y93KQjy7G55riF1cMo03ipL3

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4800-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4800-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	4800	WerFault.exe	90

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 4800	1900	rundll32.exe	90
PID 1900 wrote to memory of 4800	1900	rundll32.exe	90
PID 1900 wrote to memory of 4800	1900	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0aa6cd26f2a6e7aef4b8946a0158bba57f5f4cfab5691ea7ac3f1dd4371e84db_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0aa6cd26f2a6e7aef4b8946a0158bba57f5f4cfab5691ea7ac3f1dd4371e84db_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 712
    3⤵
    - Program crash
    PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 4800
1⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:3668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4800-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4800-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download