Analysis
-
max time kernel
150s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01-07-2024 03:57
General
-
Target
339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6_NeikiAnalytics.exe
-
Size
464KB
-
MD5
9a447000b85d7de1126b582fddbc8b80
-
SHA1
6494158c11818343308c337760514020800a5be2
-
SHA256
339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6
-
SHA512
568d054438a883404b75645a7d8ba87b9cc0f1fe218e31f3a980031a63332f41a7060b64fd74bb1c5d68d292b11c55de2771b3e9b0baf470d85ece60434dab42
-
SSDEEP
6144:mSkWcDpi78KSrafqV5areuyFwBqgmGNGXN/O8OCLSlGwlkmTgsbrNZqiSbKVs77r:mSlc87eqqV5e+wBV6O+mllLTTHByKm7/
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\339aa603038d2f5a286cae50fa129457f5503d9926c0038b5f8f1691909937a6_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\powetar\makeshta.exe"C:\Users\Admin\AppData\Roaming\powetar"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~46BD.tmp3436 475656 2348 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Certance.exeC:\Windows\SysWOW64\Certance.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~46BD.tmpFilesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
C:\Windows\SysWOW64\Certance.exeFilesize
464KB
MD590d2da231be275cf6138c1971059f6a8
SHA12f8c62131fc1e60e3f07e9b038226f97885f4a49
SHA256279651e0677b836ab7506b3d7410e209db5d90f3ffcaa65a294b9cd27c040e47
SHA51287afffb54e80f509670716421508576021387320287876e7229ce3e9b5746244b9e4b56adf495a23964df903762d97b922f5c35786d670f79e6f5f03e8797d9b
-
memory/2348-7-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2348-8-0x0000000000550000-0x00000000005CD000-memory.dmpFilesize
500KB
-
memory/2348-9-0x0000000000680000-0x0000000000685000-memory.dmpFilesize
20KB
-
memory/2348-29-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/3300-1-0x00000000005C0000-0x000000000063D000-memory.dmpFilesize
500KB
-
memory/3300-0-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/3300-28-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/3436-16-0x0000000002D60000-0x0000000002DE4000-memory.dmpFilesize
528KB
-
memory/3436-26-0x0000000002E40000-0x0000000002E46000-memory.dmpFilesize
24KB
-
memory/3436-25-0x0000000002D60000-0x0000000002DE4000-memory.dmpFilesize
528KB
-
memory/3436-27-0x0000000002E50000-0x0000000002E5D000-memory.dmpFilesize
52KB
-
memory/3652-20-0x0000000000720000-0x000000000079D000-memory.dmpFilesize
500KB
-
memory/3652-17-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB