Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11-05-2024 09:28

General

  • Target

    aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe

  • Size

    5.6MB

  • MD5

    aaef9cfdc0033a3a257082003c9ad8c0

  • SHA1

    0fd44c6624247fe9b22a6cf4acba3078f724e865

  • SHA256

    efcd01e84288ce7aa9e6201c848e987735673f583dd96c4e1561a10af3f3d4e2

  • SHA512

    0f363ef57931a2efc77cd07e51bca807ed21d97e9d70d32a17f4da2741881fbea599b59eadf57351825f8bb2217709630e19a40671c56daa9aceb259512b07d6

  • SSDEEP

    24576:LlQsYsFP+ma/ZSC+gVue+zxa/ZSrJovBYTqT2RUOa/ZSAajJBMqAX1Ea/ZSOue+m:LlOsV+mgxbV8xgClgCo/ugD8xgClg9

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 144
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe

    Filesize

    5.6MB

    MD5

    12e8bd04ffd62652e6eeb5b6866d11cb

    SHA1

    cbd2f22b0ab581302661db0f0cb83b63b75fb3db

    SHA256

    f6d5da08a1dd2bd2cdcaaf993c75437555fc33a205a7e09e7d0f2a8981571465

    SHA512

    dcba6d90889a8a338feac12fac4f43e66228a4f4a4b100e045c1bfdcc3895dd957d5fcace2690e56101f0a84c3096b53990670256265525385b7ab01f72274db

  • memory/1240-0-0x0000000000400000-0x00000000004F3000-memory.dmp

    Filesize

    972KB

  • memory/1240-7-0x0000000000400000-0x00000000004F3000-memory.dmp

    Filesize

    972KB

  • memory/1864-9-0x0000000000400000-0x00000000004F3000-memory.dmp

    Filesize

    972KB

  • memory/1864-10-0x0000000002EF0000-0x0000000002FE3000-memory.dmp

    Filesize

    972KB