4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 10:38

Target

4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe
Size

515KB
MD5

caf99b057e351fd3c4e0147852e3aca0
SHA1

317cfe56e322b76c7ca024689928ebe0b5246fa5
SHA256

4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251
SHA512

ae736c8e45764e96cc961e9fd2fbd6fcd04216fb25dbcabc12cee74d09948bfa1c714ca650bd9248d3d523e0145bde97d21e2a105eb51ae3a7b2836bcead1563
SSDEEP

12288:ZK4naUrLNJZ+1bTvcxxVQR0xqCjTZtTy8SRFTpxOeyrE6yzD:s4nVRJgpvRqDjTjy8SRFf1yrEZ

Score

10^/10

Credentials

Executes dropped EXE 1 IoCs

pid	Process
2424	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1752	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe
1752	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\60df5ee1\jusched.exe	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe
File created	C:\Program Files (x86)\60df5ee1\60df5ee1	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2424	1752	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe	28
PID 1752 wrote to memory of 2424	1752	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe	28
PID 1752 wrote to memory of 2424	1752	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe	28
PID 1752 wrote to memory of 2424	1752	4b5bbf16354c82ca736f9f977faac83698219c2c5713cdcb81902b0c3b531251_NeikiAnalytics.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\60df5ee1\60df5ee1

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
\Program Files (x86)\60df5ee1\jusched.exe

Filesize
515KB

MD5
96150814317ced76164cb156956190b9

SHA1
0d16010fb15111e478de4d9f4ebd017180cee513

SHA256
320482796e0fbb0496c2fdbdffaa497c14c9c32a91c7e1805b23c5bfb1e19e26

SHA512
2d88aba3c5a873607c1e25b303e1937a8e3ae0a2e744def7365e7093608d32c832c408b275d530984206b0b00a1f55fa5b568d7def38df8f4828a5e5f1cd5b06

Download Submit
memory/1752-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1752-6-0x0000000004A30000-0x0000000004A5C000-memory.dmp

Filesize
176KB

Download
memory/1752-13-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1752-10-0x0000000004A30000-0x0000000004A5C000-memory.dmp

Filesize
176KB

Download
memory/2424-14-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download