bb4669e8892114f56236c8c253d02ef801da22bba2f29ac43f81ff1110cdf2a7

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a6e2197bd734530e0b3a7dbe591bd70_NeikiAnalytics.exe
Size

3.8MB
MD5

2a6e2197bd734530e0b3a7dbe591bd70
SHA1

3f4b08b93fc2bd4b76d76bb0c5bd8dfd46aa32a6
SHA256

bb4669e8892114f56236c8c253d02ef801da22bba2f29ac43f81ff1110cdf2a7
SHA512

559df98dd601f6171aec3dfbb83720ca93a35843bf2b3ed740371daeaa8832b97c7b2c461601e81a4e464275c8d8d31ae21937c6954582b393f22a399707c242
SSDEEP

49152:ftdvFBpDB0fc7vgSbPGn4J1OeMVwKFbnN5qGuwn64TcHfEOQ8:VJnpDKugSbPGn6Mtbxp6rj

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1752	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4788	4840	2a6e2197bd734530e0b3a7dbe591bd70_NeikiAnalytics.exe	93
PID 4840 wrote to memory of 4788	4840	2a6e2197bd734530e0b3a7dbe591bd70_NeikiAnalytics.exe	93
PID 4840 wrote to memory of 4788	4840	2a6e2197bd734530e0b3a7dbe591bd70_NeikiAnalytics.exe	93
PID 4788 wrote to memory of 1752	4788	cmd.exe	95
PID 4788 wrote to memory of 1752	4788	cmd.exe	95
PID 4788 wrote to memory of 1752	4788	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2a6e2197bd734530e0b3a7dbe591bd70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a6e2197bd734530e0b3a7dbe591bd70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\2a6e2197bd734530e0b3a7dbe591bd70_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3672 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4840-0-0x0000000000400000-0x00000000007C9000-memory.dmp

Filesize
3.8MB

Download
memory/4840-1-0x0000000000400000-0x00000000007C9000-memory.dmp

Filesize
3.8MB

Download
memory/4840-2-0x0000000000400000-0x00000000007C9000-memory.dmp

Filesize
3.8MB

Download