Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe
-
Size
96KB
-
MD5
a06dc5755360e9e29abaeddc103005a0
-
SHA1
ea43f66cfd5b1cc67fb103f1bc6618026a4fa32c
-
SHA256
030c517fee13f5bdb7c99c4e5ea6f209e715835d198c2928f0a5c16755aac6e7
-
SHA512
33b35b67202ac5ac2ed22f0c44232f5f31d3a4471a4cdab0b58fb50cc6fc782a646cf951d64121ed716b49800a580e4988fa7232a2f153db6f7115ac3378ffe2
-
SSDEEP
1536:TalEkKgJOyjc4oqULVJBoLmcYXV/O16nvaHWpeQrZYTjipvF2uN1PomZ:vbOHw5qLmcYXVlnvk8YvQd22T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2524 antifahib.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 icanhazip.com -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1464 wrote to memory of 2524 1464 a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe 82 PID 1464 wrote to memory of 2524 1464 a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe 82 PID 1464 wrote to memory of 2524 1464 a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\antifahib.exeC:\Users\Admin\AppData\Local\Temp\antifahib.exe2⤵
- Executes dropped EXE
PID:2524
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD54f23e0c0c2cab633cf1e87d83ebaa8a0
SHA11bcb60b86b1394eea2febda097fdf842fc87d79f
SHA25679fd9aa6fa1805e5d1152a66a29fbcec7d13f3a7ae882745db20ec49f86667b6
SHA512f2e2936e33b3823af3a81815e3184b427a3daddc0b809b622b0aacf0545bc0623a087df362575f686c05c80a9a4174e62c5a336e93bf8920e4c48d76c66462ce