Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 00:34
Static task
static1
Behavioral task
behavioral1
Sample
2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe
-
Size
68KB
-
MD5
2ec3ae13b9bdc2dfdb598e20ae327fd0
-
SHA1
601e71150f9440e33570b5baccffd067c1ab2e3c
-
SHA256
f9578cf7b4915ec42d1f9954299ed34bb85e701101e024e65309c8a7a550ec69
-
SHA512
e2a5481e21395591db9a42d00e69330c362f44544b74eaedaf6e5fea491005fd2709d7ddaa1dfb57ba5f35302bf1613706c58887e8de3bb246cb95684b30a175
-
SSDEEP
1536:5Y9jw/dUT62rGdiUOWWrMffJ+AxM+I+ceWgP/KmVQV:5Y9CUT62/UOVMffJ+AW+I+cR
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 2136 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exepid process 3000 2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe 3000 2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exedescription pid process target process PID 3000 wrote to memory of 2136 3000 2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe szgfw.exe PID 3000 wrote to memory of 2136 3000 2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe szgfw.exe PID 3000 wrote to memory of 2136 3000 2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe szgfw.exe PID 3000 wrote to memory of 2136 3000 2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\szgfw.exeFilesize
68KB
MD5af961505f1288fd14840bfa98bc066ed
SHA163a5fdee67545c9e41a718acf981614f1c183351
SHA256b7bacf8d43b5f2ced83fc4a7de3aace9400f2bee01f61807764d37e710c8642e
SHA51273b55978c21621473353c10be7c07959fa536d792bdd8994160439a2550d3f6dc9c947198a71096c157dcae2664437fb1162f0c50d9e7d5cd30c3495cc36b522
-
memory/2136-12-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3000-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3000-10-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB