06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exe
Size

3.7MB
MD5

bbe02193dec0f7cdf4aa2d66e80d5b60
SHA1

33e017cba926c765610af9568f7edc5e3962a6b3
SHA256

06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b
SHA512

e8894da401a2cf1532bbbd5cb54a9449f3418ebda72c205b22e3a6c90a7c89d59ab51bc68566b668249fab5f180a2cde7c7ad12289109f651b02f1b0c895a175
SSDEEP

98304:e3obcEffDvnh88mNuHMiABZlZlpGiuKvBGMQ9jfQ:es7nhVPPiXHGbkAhlQ

Score

8^/10

persistence privilege_escalation vmprotect

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
Executes dropped EXE 1 IoCs

Processes:

sruldjl.exe

pid process

2604 sruldjl.exe

pid	process
2604	sruldjl.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x00000000009A3000-memory.dmp	vmprotect
behavioral1/memory/2196-1-0x0000000000400000-0x00000000009A3000-memory.dmp	vmprotect
C:\PROGRA~3\Mozilla\sruldjl.exe	vmprotect
behavioral1/memory/2604-8-0x0000000000400000-0x00000000009A3000-memory.dmp	vmprotect

Drops file in Program Files directory 2 IoCs

Processes:

06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exesruldjl.exe

description	ioc	process
File created	C:\PROGRA~3\Mozilla\sruldjl.exe	06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exe
File created	C:\PROGRA~3\Mozilla\tqtzzel.dll	sruldjl.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exesruldjl.exe

pid process

2196 06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exe
2604 sruldjl.exe

pid	process
2196	06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exe
2604	sruldjl.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2332 wrote to memory of 2604	2332	taskeng.exe	sruldjl.exe
PID 2332 wrote to memory of 2604	2332	taskeng.exe	sruldjl.exe
PID 2332 wrote to memory of 2604	2332	taskeng.exe	sruldjl.exe
PID 2332 wrote to memory of 2604	2332	taskeng.exe	sruldjl.exe

C:\Users\Admin\AppData\Local\Temp\06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06df019453fefca35d2f703566b52d626f56c0c56e44d58f336cc18307d6f11b_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2196

C:\Windows\system32\taskeng.exe
taskeng.exe {623CC55B-C0B1-40AA-BE15-B3803B848628} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\PROGRA~3\Mozilla\sruldjl.exe
C:\PROGRA~3\Mozilla\sruldjl.exe -tmajfck
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2604

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\sruldjl.exe
Filesize
3.7MB

MD5
8a074048a990e5d59b4cad80449633d1

SHA1
068385fdfcbd7ef79493f52201f2cb8833608c5b

SHA256
32dbee01f9a3eeb25f934172f4e8c2ef47f22e04d142b1a2de56fc002cd354dd

SHA512
e206c7642941bedb243944a7a5bc783373347d73286e3e108960a0d585889b751273d0fef84ceafcb1df528a4e8a6d0f258d382074704c7a83277f425288c3cd

Download Submit
memory/2196-0-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/2196-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2196-1-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/2196-2-0x0000000000A20000-0x0000000000A7B000-memory.dmp

Filesize
364KB

Download
memory/2196-5-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2604-8-0x0000000000400000-0x00000000009A3000-memory.dmp

Filesize
5.6MB

Download
memory/2604-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2604-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads