570022a20d3e2fdafb0e6cca7d8f282799247b514e1ddd41a1d48f4dfc8f44a1

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

570022a20d3e2fdafb0e6cca7d8f282799247b514e1ddd41a1d48f4dfc8f44a1_NeikiAnalytics.exe
Size

145KB
MD5

cdc8cba54e30d3b865a1318b2f5af3b0
SHA1

691753a20e520a84dbdb52da77dbe52bcc1177d5
SHA256

570022a20d3e2fdafb0e6cca7d8f282799247b514e1ddd41a1d48f4dfc8f44a1
SHA512

b682933009a0f6b03445efb128fc9dc118c87775609154b4e838e4614fbf5c6df5f429fc0fd36ad0073b2b4e172910f0a83b84a724e86c6217b3418f22cc51e8
SSDEEP

3072:TiS4omp03WQthI/9S3BZi08iRQ1G78IVn28bSQcJ88lt6uO:TiS4ompB9S3BZi0a1G78IVjcuctG

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	net.exe

Runs net.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2692	4452	570022a20d3e2fdafb0e6cca7d8f282799247b514e1ddd41a1d48f4dfc8f44a1_NeikiAnalytics.exe	84
PID 4452 wrote to memory of 2692	4452	570022a20d3e2fdafb0e6cca7d8f282799247b514e1ddd41a1d48f4dfc8f44a1_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\570022a20d3e2fdafb0e6cca7d8f282799247b514e1ddd41a1d48f4dfc8f44a1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\570022a20d3e2fdafb0e6cca7d8f282799247b514e1ddd41a1d48f4dfc8f44a1_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SYSTEM32\net.exe
  "net" use X: \\a300\share /persistent:yes
  2⤵
  - Enumerates connected drives
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads