Analysis
-
max time kernel
93s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 08:28
Static task
static1
Behavioral task
behavioral1
Sample
adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe
-
Size
95KB
-
MD5
adde71246bb911896f8c15cba816f870
-
SHA1
2f26b6a82b9be3f92b1f42e85c034a535d4ab090
-
SHA256
1cb3074594877dfa3f3e260b6e91140f28e0ad1933b97e8772e60f14aa7e7718
-
SHA512
1415dcc5183bcb02741421315ce37fbd2a9d95409dfe0e1d2972964b87c02864b7b443501b84b64a8146e33ff7b979d3256247a763ca4f615431aabd3e1b53db
-
SSDEEP
1536:SomHrhA83m7or2mAq/qIwM4Y1DYfyM+5bQaSOmwzeNef7juRIDJIT7jwO:ezwoB9wM5EfybbQz3Nef+Qa
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1400 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1400 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2960 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2960 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe 1400 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2960 wrote to memory of 1400 2960 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe 83 PID 2960 wrote to memory of 1400 2960 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe 83 PID 2960 wrote to memory of 1400 2960 adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\adde71246bb911896f8c15cba816f870_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\adde71246bb911896f8c15cba816f870_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1400
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD59ae9172e71235dac17bad8cb088c3af9
SHA1b9962e13645a214ccc21fbb85b39262d864aa1f7
SHA256dd39cf98818ab46f0d379237bb3d6669da84cac20db3855bae8611389d7aed75
SHA512a47ab0b2311127f368e8bb0dcc18ff32249754ab35d046e5096dd1f4725fb37ce75bb31f9b6c38dfc72c003708893933f38aa807652809993e2e4add2f2b9d8c