3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9

Analysis

max time kernel
17s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe
Size

889KB
MD5

049b2ab943f44cee4bff14bbe1b15d00
SHA1

e42907fdf7dd8c0d40ffa98083414e1330b0f5ad
SHA256

3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9
SHA512

f2729cc4abc2d65ab61b3030443b00b4cd543d22343bd4edc8ca838df3ee3fb87dd025a21d87cf209c537812720ba86a458c672637b7d1ca01d3316fc9ba523e
SSDEEP

24576:WbE+qu/OfDlEUKWflmTP33GiLmqxrt35E3MvZ:WbE+4fU4Uj33i3+Z

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

MSWDM.EXEMSWDM.EXE3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE

pid	process
5028	MSWDM.EXE
1752	MSWDM.EXE
5064	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
3372	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE

Loads dropped DLL 1 IoCs

Processes:

3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE

pid process

3372 3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE

pid	process
3372	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exeMSWDM.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

Processes:

3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe

description	ioc	process
File created	C:\WINDOWS\MSWDM.EXE	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe
File opened for modification	C:\Windows\dev5469.tmp	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSWDM.EXE

pid process

1752 MSWDM.EXE
1752 MSWDM.EXE

pid	process
1752	MSWDM.EXE
1752	MSWDM.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exeMSWDM.EXE3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE

description	pid	process	target process
PID 1900 wrote to memory of 5028	1900	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe	MSWDM.EXE
PID 1900 wrote to memory of 5028	1900	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe	MSWDM.EXE
PID 1900 wrote to memory of 5028	1900	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe	MSWDM.EXE
PID 1900 wrote to memory of 1752	1900	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe	MSWDM.EXE
PID 1900 wrote to memory of 1752	1900	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe	MSWDM.EXE
PID 1900 wrote to memory of 1752	1900	3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe	MSWDM.EXE
PID 1752 wrote to memory of 5064	1752	MSWDM.EXE	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
PID 1752 wrote to memory of 5064	1752	MSWDM.EXE	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
PID 1752 wrote to memory of 5064	1752	MSWDM.EXE	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
PID 5064 wrote to memory of 3372	5064	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
PID 5064 wrote to memory of 3372	5064	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
PID 5064 wrote to memory of 3372	5064	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE	3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE

C:\Users\Admin\AppData\Local\Temp\3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1900

C:\WINDOWS\MSWDM.EXE
"C:\WINDOWS\MSWDM.EXE"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5028

C:\WINDOWS\MSWDM.EXE
-r!C:\Windows\dev5469.tmp!C:\Users\Admin\AppData\Local\Temp\3382769637ab47fb03fc3a8203852e1b217c442860cedb330bcba7036c280bd9_NeikiAnalytics.exe! !
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\Temp\{9E65D1B6-52F8-4224-AAE5-A9941EDC48F8}\.cr\3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE
"C:\Windows\Temp\{9E65D1B6-52F8-4224-AAE5-A9941EDC48F8}\.cr\3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\3382769637AB47FB03FC3A8203852E1B217C442860CEDB330BCBA7036C280BD9_NEIKIANALYTICS.EXE" -burn.filehandle.attached=568 -burn.filehandle.self=696
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3372

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\MSWDM.EXE
Filesize
47KB

MD5
5a9dd74de3cb36afe080f388e136acbd

SHA1
bc6cef3cc66a75d5bf1819e277c938292d35fb93

SHA256
8d0c776812a00ea63c152682dc3a0eacdb5438fa407068eb58d43ef6c6ea9c31

SHA512
6d58cbbd2d5c1ce50475172cd3032c931a2c9fd485d1b90858a2353e0d2329bc1979f0e98f479fc9d90b6c18c54e5c745c31ee962846119a6d9031c1cc3daf8a

Download Submit
C:\Windows\Temp\{20E4B1EE-CAD5-4404-9814-5447D9E94358}\.ba\PythonBA.dll
Filesize
600KB

MD5
910d34f4b8e8c40e2c7ea16335c7a27c

SHA1
d1ded5742bd647c688f2749cce0093b6a71b56f4

SHA256
c143b40448e90687587bb7ecb376e96db469f347c0921863af468181fab972e3

SHA512
be3ad1e5fbb4a3c65051b54c70d94f8e14edbbae69ff5670ce7d615171182da9aaeb2004c97c4c76689ce359e71a595cd5931f3500ef7fba001af8e68715084d

Download Submit
C:\Windows\Temp\{20E4B1EE-CAD5-4404-9814-5447D9E94358}\.ba\SideBar.png
Filesize
56KB

MD5
ca62a92ad5b307faeac640cd5eb460ed

SHA1
5edf8b5fc931648f77a2a131e4c733f1d31b548e

SHA256
f3109977125d4a3a3ffa17462cfc31799589f466a51d226d1d1f87df2f267627

SHA512
f7b3001a957f393298b0ff2aa08b400f8639f2f0487a34ac2a0e8d9519765ac92249185ebe45f907bc9d2f8556fdd39095c52f890330a35edf71ae49df32e27a

Download Submit
C:\Windows\dev5469.tmp
Filesize
841KB

MD5
f33aac555c5e5a2c10d07e3bbf9a9e82

SHA1
75fa5322fdc00223246bc70fcb6772ae9f10e97c

SHA256
8977d454b74e2abbafc3be6a3b2e7946d1cde530d742235bc1e5cc229e231aa6

SHA512
a64d465c327cd3799044fa1e8786812e055b72aea7faeac66916c7cf1f762bb919d211060cc7944b84037c316babb796ef449d1049a162d8faa51b08d05cef34

Download Submit
memory/1752-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1900-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1900-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5028-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5028-71-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download