Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 04:00

General

  • Target

    65bbdbb336e5a26899ba5b75e5e334b0_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    65bbdbb336e5a26899ba5b75e5e334b0

  • SHA1

    a989935f2d62bc6f72e8bebec6bb93257c45f3c5

  • SHA256

    2a8e249c162b543b0ad2eb912166cbc9d8310fa15243cc937ffc334f5a95f6cc

  • SHA512

    130e08d9f023175b9503f52cd5cad519ab433b7ae5670809b692926a16572b74640e13cc807ea89ff6f958e13a10fef77e5dfeb63f573a2cf5fa7cdb3d866cc0

  • SSDEEP

    1536:hbK6B3YLsGjFk/K5QPqfhVWbdsmA+RjPFLC+e5hj0ZGUGf2g:hX3YLsGoNPqfcxA+HFshjOg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65bbdbb336e5a26899ba5b75e5e334b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\65bbdbb336e5a26899ba5b75e5e334b0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c [email protected]
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Users\Admin\AppData\Local\Temp\[email protected]
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1432
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 00.exe
          4⤵
            PID:2176

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \Users\Admin\AppData\Local\Temp\[email protected]

            Filesize

            73KB

            MD5

            a6849bf37c7c7b7d66fbef18d702a634

            SHA1

            3287acf40695ddbc9616e7724e1f1bf89cd62443

            SHA256

            57920c509306fef8403d6c96a7a5ef3f7230aa136f0910e0059ae054cde1485f

            SHA512

            8766c277877030664fc35aeb956842f49beeefe35429f179f3eabf9da660f0df0c70d3cbc6f3eca0df984e8f04a0ffeb38d42a43436f5a7dead052ed5a7a9b13

          • memory/1432-10-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB

          • memory/3008-11-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB