Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 07:56
Behavioral task
behavioral1
Sample
a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe
-
Size
529KB
-
MD5
a7767274a4799d936b58d3946deed650
-
SHA1
244e7229c233fee50b4a1826c47be23aded480f6
-
SHA256
c59d439740eaed321bc13f0bc71146cea479b589e8d10d44085898055dd9dcc6
-
SHA512
8bbcd8cdf2488cb2e52620dbb96ffa65d59f460db7dba6e8282fbb777faf10445317a27b87035949441001bea9294f2d9b95c12d6818d20080e088bc8c5ea544
-
SSDEEP
12288:uomtZneH0RFnR4bb+o8RNw0Axf0PRtzfUQRX+:knXFGiZZCf0ZtzMQ4
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2988-1-0x0000000001000000-0x0000000001086000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a7767274a4799d936b58d3946deed650_NeikiAnalytics.exedescription pid process target process PID 2988 set thread context of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2500 2520 WerFault.exe RegAsm.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
a7767274a4799d936b58d3946deed650_NeikiAnalytics.exeRegAsm.exedescription pid process target process PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2988 wrote to memory of 2520 2988 a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe RegAsm.exe PID 2520 wrote to memory of 2500 2520 RegAsm.exe WerFault.exe PID 2520 wrote to memory of 2500 2520 RegAsm.exe WerFault.exe PID 2520 wrote to memory of 2500 2520 RegAsm.exe WerFault.exe PID 2520 wrote to memory of 2500 2520 RegAsm.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 2563⤵
- Program crash
PID:2500