Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 22:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe
-
Size
1.9MB
-
MD5
125e117a5a4ccf6eb9ae5919bdc63120
-
SHA1
120e97456c5df1e6fe5ce6dd851b71cf53d9ee9d
-
SHA256
44871f4e98823b32cd92f52ec0c57f35fe561def1a99d7f141fcfe135586625c
-
SHA512
f581e2694159bc195c21a2e9c58d2acf1eb3116e028d987f922c3a7f2216abe36d8923b063feecba12c369464eb4d00f1c15d0263368b4788c572a41b07e6016
-
SSDEEP
24576:V3e1mtAh5jfOLY78aHNrVtchHqk00vuk+j3OyKkRTEtEpOOCHBIZU40Q592Dv/eY:Vnuz7X+90y+j3SYOOChTQlk
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2984 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2132 PING.EXE -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 1 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeCreateTokenPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeAssignPrimaryTokenPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeLockMemoryPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeIncreaseQuotaPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeMachineAccountPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeTcbPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeSecurityPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeTakeOwnershipPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeSystemProfilePrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeSystemtimePrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeProfSingleProcessPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeIncBasePriorityPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeCreatePagefilePrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeCreatePermanentPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeBackupPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeRestorePrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeShutdownPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeDebugPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeAuditPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeSystemEnvironmentPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeChangeNotifyPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeRemoteShutdownPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeUndockPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeSyncAgentPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeEnableDelegationPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeManageVolumePrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeImpersonatePrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: SeCreateGlobalPrivilege 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 31 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 32 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 33 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 34 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 35 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 36 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 37 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 38 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 39 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 40 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 41 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 42 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 43 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 44 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 45 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 46 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 47 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe Token: 48 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2984 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 2984 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 2984 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 2984 2932 125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe 28 PID 2984 wrote to memory of 2132 2984 cmd.exe 30 PID 2984 wrote to memory of 2132 2984 cmd.exe 30 PID 2984 wrote to memory of 2132 2984 cmd.exe 30 PID 2984 wrote to memory of 2132 2984 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.execmd /c ping 1.1.1.1 -n 1 -w 32 & del /F /S /Q "C:\Users\Admin\AppData\Local\Temp\125e117a5a4ccf6eb9ae5919bdc63120_NeikiAnalytics.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 323⤵
- Runs ping.exe
PID:2132
-
-