Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 10:49

General

  • Target

    a47e2e924bf7fe8d87a9ceb7395dbf28bb7da0004c9c829df71c8eafbe374841_NeikiAnalytics.exe

  • Size

    205KB

  • MD5

    c2cbb0441726f5d3035811069994c450

  • SHA1

    43981bfb4ac86e324ab7933e98aad8a4de7557ad

  • SHA256

    a47e2e924bf7fe8d87a9ceb7395dbf28bb7da0004c9c829df71c8eafbe374841

  • SHA512

    4587912035853d6f1f73c99fba51650d29a3a2b48a2fd1804a4b556b195d03b01ebadf84a3a3de0d20d1659b3673f87cef6db8bd6ffe841aae3f425ac0b3accc

  • SSDEEP

    3072:2+ejgWgTsDAJJRjOV2/pwb5ryT5tlDhB2IFTLFZhh2D+0caj3kyRACHf5:qjg3JJF35tlDhB2Cn9ozHf5

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a47e2e924bf7fe8d87a9ceb7395dbf28bb7da0004c9c829df71c8eafbe374841_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a47e2e924bf7fe8d87a9ceb7395dbf28bb7da0004c9c829df71c8eafbe374841_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1088
  • C:\PROGRA~3\Mozilla\onvmijj.exe
    C:\PROGRA~3\Mozilla\onvmijj.exe -ibpmpgd
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:3448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Mozilla\onvmijj.exe

    Filesize

    205KB

    MD5

    2d5182d13e439f0f3e36bfb1d6f85fde

    SHA1

    4212b9ecc68f6132ae387fc2f56785bc1d4be940

    SHA256

    f9637f4541cbfe8fd0475c02b686f198599f635594351bda64e9887a354065f7

    SHA512

    d153a0fbf83f1b412b81b5ee485c9f8d444fd30c403def8bbf5d64501e80012dd90c92ae8b454dc5a133c28bab990f88145b9f68089a584544435e4ac1e1bf26

  • memory/1088-0-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/1088-1-0x00000000020E0000-0x000000000213B000-memory.dmp

    Filesize

    364KB

  • memory/1088-2-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1088-11-0x00000000020E0000-0x000000000213B000-memory.dmp

    Filesize

    364KB

  • memory/1088-10-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/3448-6-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/3448-8-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/3448-13-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB