2edb36a04587a2190ff2024880b2349dcfb5f46c57d5947f1230474d89743327

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
Size

192KB
MD5

8b72719cde7c92b37bb9739f25f5ee70
SHA1

dd1384d9e174e3f77c7866d416279fbfe81f49fe
SHA256

2edb36a04587a2190ff2024880b2349dcfb5f46c57d5947f1230474d89743327
SHA512

744328681a08377224aca829ea5bd5586e6e24bd9cc9ebb64f34c3353679a5efdf13794492886c28eee506828ebda4d0d3f77c5a6622d6e9edffafa61b8fcea4
SSDEEP

3072:E+eYVwTVQsoNW7aNJAlKiufw59ck+RABrMAcBSOX5NwnA74NNI4gRSsuCZq:swxN6cJAwbw06lMhBSOX9ENIDEqZq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3664	8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3664	8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1912	4720	WerFault.exe	81
2988	3664	WerFault.exe	88
3648	3664	WerFault.exe	88
3224	3664	WerFault.exe	88
4452	3664	WerFault.exe	88
3164	3664	WerFault.exe	88
3760	3664	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4720	8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3664	8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3664	4720	8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe	88
PID 4720 wrote to memory of 3664	4720	8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe	88
PID 4720 wrote to memory of 3664	4720	8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 384
  2⤵
  - Program crash
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 356
    3⤵
    - Program crash
    PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 768
    3⤵
    - Program crash
    PID:3648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 808
    3⤵
    - Program crash
    PID:3224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 804
    3⤵
    - Program crash
    PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 784
    3⤵
    - Program crash
    PID:3164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 824
    3⤵
    - Program crash
    PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4720 -ip 4720
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3664 -ip 3664
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3664 -ip 3664
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3664 -ip 3664
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3664 -ip 3664
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3664 -ip 3664
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3664 -ip 3664
1⤵
PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe

Filesize
192KB

MD5
853323f06d1743a60df268bebde11c2a

SHA1
0b620b9315beb5132fbc910f64d847ca60ebcae9

SHA256
85acddf5ed69355147695205d2f7ce837f1f6badd82cbb8e6b340acbb93231d1

SHA512
166fb8d120dd192be6348e331cdbf7bafb731483d1d7fa69e8d3e724ce6ef68ca4e318bca94f3a901916fad4e7a7b4437252137829cec9f8c3156237a859e3db

Download Submit
memory/3664-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3664-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3664-14-0x00000000014E0000-0x0000000001518000-memory.dmp

Filesize
224KB

Download
memory/4720-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4720-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download