Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
01-07-2024 03:57
General
-
Target
339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6_NeikiAnalytics.exe
-
Size
464KB
-
MD5
9a447000b85d7de1126b582fddbc8b80
-
SHA1
6494158c11818343308c337760514020800a5be2
-
SHA256
339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6
-
SHA512
568d054438a883404b75645a7d8ba87b9cc0f1fe218e31f3a980031a63332f41a7060b64fd74bb1c5d68d292b11c55de2771b3e9b0baf470d85ece60434dab42
-
SSDEEP
6144:mSkWcDpi78KSrafqV5areuyFwBqgmGNGXN/O8OCLSlGwlkmTgsbrNZqiSbKVs77r:mSlc87eqqV5e+wBV6O+mllLTTHByKm7/
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\calcdkey\taskdctr.exe"C:\Users\Admin\AppData\Roaming\calcdkey"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~2414.tmp1204 475656 2244 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\expl_ssp.exeC:\Windows\SysWOW64\expl_ssp.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~2414.tmpFilesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
\Users\Admin\AppData\Roaming\calcdkey\taskdctr.exeFilesize
464KB
MD57a748b44dc0772a755ddba98cbb391ba
SHA14ef6079032b8e5ce81b5bda737019c9f814ddecb
SHA2561753c40a731f83c5a387adba5f239f5011649c2bcd848a66f0c264085d31dbba
SHA51205d13d5c3937aeff53fba14f693e89be84208b5f1af0579c92822d34ce0bf2dcbb63f5f6c36f87fde3dd14f1fc8f05c0558653006fc837e10f1dfe8b108dc486
-
memory/1204-35-0x0000000002E90000-0x0000000002E96000-memory.dmpFilesize
24KB
-
memory/1204-21-0x0000000004270000-0x00000000042F4000-memory.dmpFilesize
528KB
-
memory/1204-36-0x0000000002EA0000-0x0000000002EAD000-memory.dmpFilesize
52KB
-
memory/1204-24-0x0000000004270000-0x00000000042F4000-memory.dmpFilesize
528KB
-
memory/1204-20-0x0000000004270000-0x00000000042F4000-memory.dmpFilesize
528KB
-
memory/2116-29-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2116-31-0x0000000000220000-0x000000000029D000-memory.dmpFilesize
500KB
-
memory/2220-1-0x0000000000220000-0x000000000029D000-memory.dmpFilesize
500KB
-
memory/2220-0-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2220-11-0x0000000000300000-0x000000000037B000-memory.dmpFilesize
492KB
-
memory/2220-10-0x0000000000300000-0x000000000037B000-memory.dmpFilesize
492KB
-
memory/2244-15-0x0000000000220000-0x000000000029D000-memory.dmpFilesize
500KB
-
memory/2244-16-0x00000000002C0000-0x00000000002C5000-memory.dmpFilesize
20KB
-
memory/2244-26-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB