Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 09:28
Static task
static1
Behavioral task
behavioral1
Sample
aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe
-
Size
5.6MB
-
MD5
aaef9cfdc0033a3a257082003c9ad8c0
-
SHA1
0fd44c6624247fe9b22a6cf4acba3078f724e865
-
SHA256
efcd01e84288ce7aa9e6201c848e987735673f583dd96c4e1561a10af3f3d4e2
-
SHA512
0f363ef57931a2efc77cd07e51bca807ed21d97e9d70d32a17f4da2741881fbea599b59eadf57351825f8bb2217709630e19a40671c56daa9aceb259512b07d6
-
SSDEEP
24576:LlQsYsFP+ma/ZSC+gVue+zxa/ZSrJovBYTqT2RUOa/ZSAajJBMqAX1Ea/ZSOue+m:LlOsV+mgxbV8xgClgCo/ugD8xgClg9
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1864 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1864 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe -
Loads dropped DLL 4 IoCs
pid Process 1240 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2996 1864 WerFault.exe 29 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1240 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1864 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1240 wrote to memory of 1864 1240 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 29 PID 1240 wrote to memory of 1864 1240 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 29 PID 1240 wrote to memory of 1864 1240 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 29 PID 1240 wrote to memory of 1864 1240 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 29 PID 1864 wrote to memory of 2996 1864 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 30 PID 1864 wrote to memory of 2996 1864 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 30 PID 1864 wrote to memory of 2996 1864 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 30 PID 1864 wrote to memory of 2996 1864 aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\aaef9cfdc0033a3a257082003c9ad8c0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1443⤵
- Loads dropped DLL
- Program crash
PID:2996
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD512e8bd04ffd62652e6eeb5b6866d11cb
SHA1cbd2f22b0ab581302661db0f0cb83b63b75fb3db
SHA256f6d5da08a1dd2bd2cdcaaf993c75437555fc33a205a7e09e7d0f2a8981571465
SHA512dcba6d90889a8a338feac12fac4f43e66228a4f4a4b100e045c1bfdcc3895dd957d5fcace2690e56101f0a84c3096b53990670256265525385b7ab01f72274db