Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 13:49

General

  • Target

    c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

  • Size

    274KB

  • MD5

    c919c9ef84f0b40869cc1bcf5d981fe0

  • SHA1

    3c99b304f3030c99a71e7e785d52370d78ba428f

  • SHA256

    1bd56a7fc8529a986b6276bd4eaafce486f4f70c78d8db73df642c84b2c3dc3c

  • SHA512

    9316ae9fa6ab089f61900c1bce7e435b85b381b72ce66fed6e3f2dbedc5f2f12f31150f9893c7bbb0f30c783c51c7e2dbb142cf587010d1c367dba5334aefc0a

  • SSDEEP

    6144:OULSmaOpn+0msBj1ud892ZXneB7FKNzYW0xfsLP:OUL9aO40msBjQd89U3eruufm

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

    Filesize

    274KB

    MD5

    6d70c41113e16e5f75354adfa73b0d8b

    SHA1

    e08e3f8f76e410e899f691fdeb51dca2fe596926

    SHA256

    91cef07ce8610364e4a2a8f7cf04f890fda4134a80a45d4633b79bdc1f96b108

    SHA512

    9547aef317c3900a0908209e31e0f017f29f62abb3e1d23fb062e4942dd08575368828eb55800c874da3e84a11de5366d3848746c3f73c1f4f70bab6298e6645

  • memory/2188-0-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2188-10-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2328-11-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2328-13-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB