Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe
-
Size
5.4MB
-
MD5
718f5422210e4098d930cf61a1a09f80
-
SHA1
9b010ef86a45c9881723dc43bbb85024677e29a0
-
SHA256
7583012f0fa1c3ffe4e2d191018751088b8e3a8959dc26a8e4e59669ec184d95
-
SHA512
74a91aadf1a6b8a7896c5f591d954df23a24cadb1def8357c072adf6d7574a37ee2c19d7b745d4eee48598a950e9e60bad87852936e1b056e8ebe13f9defd932
-
SSDEEP
98304:emhd1UryeDcbpVjiWKCK4F3MskEgV7wQqZUha5jtSyZIUh:eljcbp7KCXFG2QbaZtliU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 976 5A45.tmp -
Executes dropped EXE 1 IoCs
pid Process 976 5A45.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4372 wrote to memory of 976 4372 718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe 83 PID 4372 wrote to memory of 976 4372 718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe 83 PID 4372 wrote to memory of 976 4372 718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp" --splashC:\Users\Admin\AppData\Local\Temp\718f5422210e4098d930cf61a1a09f80_NeikiAnalytics.exe 5445C891BE332FCC21B4E125F74AD5450427D81FD6A7C178855488B07C455CEEE1B00C3481CE6DA6166A26F21EA98A0D9797454471DDEC1AC17DC0309AAF50DA2⤵
- Deletes itself
- Executes dropped EXE
PID:976
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD56f6a4c9192f17ceb333f636957b001c2
SHA159e3a6df5d5de0dd0cbe5ecbca3b49ced2b490ef
SHA256aecd958ebff2aea0c72a0d508586de61ce58d691c4893af17593f2de4b8ea47a
SHA5129bdeb7b1f1f6be6b907da7707e849e981fdbf6b41390ae70f98830f93ea80c35ed03d386ba5fa9607f4e500e9859e8d63e81b8a070df0b530e090c3260067601