Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
10/05/2024, 18:32
General
- Target 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe
- Size 4.2MB
- Sample240510-w62kasbc4v
- SHA256 e84d44bedee6b09ddb6c1a3866d9a192ea1ab5cc84d1c0a1fe5f8e6d90079fdb
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\zj\f.exe"C:\Program Files (x86)\zj\f.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
f.exe
memory/1656-18-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/1656-17-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/1656-28-0x0000000000400000-0x0000000000AF1000-memory.dmp
memory/1656-27-0x0000000000400000-0x0000000000AF1000-memory.dmp
memory/1656-26-0x0000000000401000-0x0000000000440000-memory.dmp
memory/1656-23-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1656-22-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/1656-21-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1656-20-0x0000000002880000-0x0000000002881000-memory.dmp
memory/1656-19-0x0000000002860000-0x0000000002861000-memory.dmp
memory/2260-16-0x000000000044C000-0x00000000006CA000-memory.dmp
memory/2260-10-0x0000000000400000-0x0000000000AF1000-memory.dmp
memory/2260-8-0x0000000000400000-0x0000000000AF1000-memory.dmp
memory/2260-7-0x0000000001130000-0x0000000001131000-memory.dmp
memory/2260-6-0x0000000001120000-0x0000000001121000-memory.dmp
memory/2260-5-0x0000000001110000-0x0000000001111000-memory.dmp
memory/2260-4-0x0000000001100000-0x0000000001101000-memory.dmp
memory/2260-3-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/2260-2-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/2260-1-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/2260-0-0x000000000044C000-0x00000000006CA000-memory.dmp
memory/2260-15-0x0000000000400000-0x0000000000AF1000-memory.dmp