Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe
-
Size
100KB
-
MD5
d1d73678477e150ceebbfc9daec53070
-
SHA1
5f8597ad91251c6f13d13596864a5dfd542872b4
-
SHA256
25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59
-
SHA512
bf70ce0429791261c030dff001077fdc950d5183b1afac03e0cfe5ef75115243e24f878c1eaead7d9bdcc1b6353c550e2c7fd78d33ead300b12c4cd2b54c837d
-
SSDEEP
1536:YyYCkvjnFk/6jW8JX/3jtzUYx5QRpeTi+ORyBeRQ2R:YyY1bFCcW8JX/zeYxVT8RMeye
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sqRLkphNDkWHwD.exepid process 2036 sqRLkphNDkWHwD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1216 25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exedescription pid process target process PID 1216 wrote to memory of 2036 1216 25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe sqRLkphNDkWHwD.exe PID 1216 wrote to memory of 2036 1216 25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe sqRLkphNDkWHwD.exe PID 1216 wrote to memory of 2036 1216 25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe sqRLkphNDkWHwD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\25b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sqRLkphNDkWHwD.exe"C:\Users\Admin\AppData\Local\Temp\sqRLkphNDkWHwD.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sqRLkphNDkWHwD.exeFilesize
100KB
MD5d1d73678477e150ceebbfc9daec53070
SHA15f8597ad91251c6f13d13596864a5dfd542872b4
SHA25625b6c8b51b839bc310e54200948099b5d16eb6a3f5ef6165c7a9f21c08b99d59
SHA512bf70ce0429791261c030dff001077fdc950d5183b1afac03e0cfe5ef75115243e24f878c1eaead7d9bdcc1b6353c550e2c7fd78d33ead300b12c4cd2b54c837d
-
memory/1216-0-0x000007FEF627E000-0x000007FEF627F000-memory.dmpFilesize
4KB
-
memory/1216-9-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmpFilesize
9.6MB