Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 03:49
Behavioral task
behavioral1
Sample
62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe
-
Size
29KB
-
MD5
62a9cdcdafa23b131f1d70229f934640
-
SHA1
d8f23cf9cb646ef56fa13cb0cdd0ec6fac40a600
-
SHA256
937181e8bb7cc22385c16af1566fade073177c7a3bbaebff4b58eed62820d037
-
SHA512
fc4d6efbdfa99406a3fe0a8f78dd5c94c146a6e6e078aed8e32a120804d68308f72b891b8e1986784725d06c502f21ba9486b3bb1f92e08efe5658fe9df2d7a9
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/o:AEwVs+0jNDY1qi/qw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2688 services.exe -
resource yara_rule behavioral1/memory/2240-4-0x0000000000220000-0x0000000000228000-memory.dmp upx behavioral1/memory/2240-3-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/files/0x0034000000015d4e-7.dat upx behavioral1/memory/2688-11-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2240-17-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2688-18-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-23-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-29-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-36-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-41-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-43-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-48-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-53-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2240-54-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2688-55-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/files/0x0005000000004ed7-68.dat upx behavioral1/memory/2240-73-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2688-74-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-78-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2240-79-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2688-80-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-85-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe File opened for modification C:\Windows\java.exe 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe File created C:\Windows\java.exe 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2688 2240 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe 28 PID 2240 wrote to memory of 2688 2240 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe 28 PID 2240 wrote to memory of 2688 2240 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe 28 PID 2240 wrote to memory of 2688 2240 62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\62a9cdcdafa23b131f1d70229f934640_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD58518b64ad7b409819ac545936252a955
SHA1303db2249d8b92ccde456238fffee5d3e862b4d5
SHA2567f0a48cbb21e260a0bfd7b4a4df0c7ed6cffbea8c03677a9baccd03f80b98849
SHA51294756a04bcdc3d573f5868054adab8ef64b5b876fbd2bcd846ef3ff2e7c13cf09638615269f078679491d123d6dd0040cd669248ab4991ab8326ce084f771458
-
Filesize
320B
MD5dd95f92d26a1dc0cc65344b638831359
SHA14514fc3db9dae48ab2621ec7ac83bf1f95d9f943
SHA2567725a3d2a0c1898ce97fb67f3f0eea67ae6a2e9d3f052af40df15fa5050620e5
SHA5120b9d6fddaad56dd67b4f773d60b4be73206dab45818a77ae6b3ff2dc8fa27e492b96e2466fc9037a829a618f6c7f29ee705e673ee96b81768aead8736adada4c
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2