Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 03:00
Behavioral task
behavioral1
Sample
55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe
-
Size
35KB
-
MD5
55c9655f5883f8b13a7878a192b12da0
-
SHA1
e4b35d2b7334b9646d69477e4154ee86d5666e50
-
SHA256
e074dbacfeea83cf23f2bab51bfbfcfa867c22e4d69ccbc49ee003d9c554c641
-
SHA512
3a01c62baebb0f5642a60c4d82bad7b8aa018e595e01ff8c65c76b51502ae0c3706054f717fb2420675335233f7977bb8f458b9792d80f95b3dfd7504a5f97cb
-
SSDEEP
768:0MAtv0KKbbI3MRNICzDHtcGquYVnP5Ep4ZA6sKNY:0MRKKbbI3MvXDHtcGquYVnPKp4ZAqG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 948 ekrakdeep.exe -
Loads dropped DLL 1 IoCs
pid Process 1972 55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/files/0x0009000000016176-3.dat upx behavioral1/memory/1972-8-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/948-10-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/948-12-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 checkip.dyndns.org -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1972 wrote to memory of 948 1972 55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe 28 PID 1972 wrote to memory of 948 1972 55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe 28 PID 1972 wrote to memory of 948 1972 55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe 28 PID 1972 wrote to memory of 948 1972 55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\55c9655f5883f8b13a7878a192b12da0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exeC:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe2⤵
- Executes dropped EXE
PID:948
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5ea44221750d7a25874b7f3c716ae6715
SHA112ed1ae0d6c3bdacae3b3cf6e18492cf1a1c678a
SHA25690c6a939b61d217da38541f5f7a1131b9b3f067df32db59f5d0d327a696e4529
SHA51241ea9ddc1c09250450f49f56b4a9e55d3aad02f20bf40fe9e3d1aa054975f6015d69789c7ab1de09c2f865af0759a8b0f6797e233482d65e222b0efad8208665