Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 17:18
Static task
static1
Behavioral task
behavioral1
Sample
2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
2e56f103fa417d2f8069b203c951b8d0
-
SHA1
38591267591c94a0cc05e0413c307e3beee05f5b
-
SHA256
6895a6e9e8c314b03a1db7c19f03f4816992a614313869b4079f33d6915e02d5
-
SHA512
42e28a738caa5616c8ad71c36d82be7e3ac4bf7744028d8a066f0fb59e4d58df5c3d4b38477e42b7a821c2dbb3d063b2af739d57c13c5018eeda107d3289f046
-
SSDEEP
1536:hbZgPaa0RNK5QPqfhVWbdsmA+RjPFLC+e5hr0ZGUGf2g:hNgeRNNPqfcxA+HFshrOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4488 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2972 wrote to memory of 808 2972 2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe 83 PID 2972 wrote to memory of 808 2972 2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe 83 PID 2972 wrote to memory of 808 2972 2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe 83 PID 808 wrote to memory of 4488 808 cmd.exe 84 PID 808 wrote to memory of 4488 808 cmd.exe 84 PID 808 wrote to memory of 4488 808 cmd.exe 84 PID 4488 wrote to memory of 3600 4488 [email protected] 85 PID 4488 wrote to memory of 3600 4488 [email protected] 85 PID 4488 wrote to memory of 3600 4488 [email protected] 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exePID:808
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:4488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:3600
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD529dc2c3839ab40d0e022240707d605dc
SHA11d8b7dbd5facf4140454886e268211721622cc00
SHA2566d3b29dd729b890de32c140ce263e44e3a189eabd5a40f42dce73439ad694901
SHA5122f47a7b952432582b1853f44c8a500a8ae09424c4b7d9acb8c680b776f1869e411414592975870f710942d33846d45ec626428a0c6434fa609cdc947643b4eb2
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1