50cb0932ead4382c5643c7adb1480af24616cc52fff7dfebd31a89e375f0f7b8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe
Size

197KB
MD5

2186c8146cb78bb669fa95595954bfb0
SHA1

e455f4abd7b5c23c87b1473bfc4e1015fdc5abce
SHA256

50cb0932ead4382c5643c7adb1480af24616cc52fff7dfebd31a89e375f0f7b8
SHA512

d1eb37c50ee68674d86098bda65b58039c14fffa34dbd7b1a2db8de6ce46873c076fe2c5f4885071f74fa26375a17e15dc6f2f4ec44e3828fb8f3e2215f11d2d
SSDEEP

6144:YB4ZdxBvEs98DwXkj3JWmZ8Zo7CyGH6Y6l:zFEsgj35rCyfv

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4324	2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4324	2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2176	116	WerFault.exe	81
1064	4324	WerFault.exe	88
4436	4324	WerFault.exe	88
1252	4324	WerFault.exe	88
3392	4324	WerFault.exe	88
4520	4324	WerFault.exe	88
3096	4324	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
116	2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4324	2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4324	116	2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe	88
PID 116 wrote to memory of 4324	116	2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe	88
PID 116 wrote to memory of 4324	116	2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 384
  2⤵
  - Program crash
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 356
    3⤵
    - Program crash
    PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 768
    3⤵
    - Program crash
    PID:4436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 780
    3⤵
    - Program crash
    PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 812
    3⤵
    - Program crash
    PID:3392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 552
    3⤵
    - Program crash
    PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 816
    3⤵
    - Program crash
    PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 116 -ip 116
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4324 -ip 4324
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4324 -ip 4324
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4324 -ip 4324
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4324 -ip 4324
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4324 -ip 4324
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4324 -ip 4324
1⤵
PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2186c8146cb78bb669fa95595954bfb0_NeikiAnalytics.exe

Filesize
197KB

MD5
c7ae40b9ce928b6437f076aa4df8ad0f

SHA1
ae3218c6c97e4deaa7a58ca7fd8f78b642d755f0

SHA256
760f8874764c0de239eded61d55c06172cd1e4d5d789a55df6775ed0e349ff6a

SHA512
22f7547cd02cc0856676b399a4f27bdbbe2aae19a787a40d8247abecb402da4a4856f1262c9b96437753f70f3c15c5c5f0ebe66371de572a6ade208b41ab3583

Download Submit
memory/116-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/116-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4324-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4324-8-0x00000000014D0000-0x000000000150F000-memory.dmp

Filesize
252KB

Download
memory/4324-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4324-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download