Analysis

  • max time kernel
    92s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 13:49

General

  • Target

    c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

  • Size

    274KB

  • MD5

    c919c9ef84f0b40869cc1bcf5d981fe0

  • SHA1

    3c99b304f3030c99a71e7e785d52370d78ba428f

  • SHA256

    1bd56a7fc8529a986b6276bd4eaafce486f4f70c78d8db73df642c84b2c3dc3c

  • SHA512

    9316ae9fa6ab089f61900c1bce7e435b85b381b72ce66fed6e3f2dbedc5f2f12f31150f9893c7bbb0f30c783c51c7e2dbb142cf587010d1c367dba5334aefc0a

  • SSDEEP

    6144:OULSmaOpn+0msBj1ud892ZXneB7FKNzYW0xfsLP:OUL9aO40msBjQd89U3eruufm

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 400
      2⤵
      • Program crash
      PID:3620
    • C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3924
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 368
        3⤵
        • Program crash
        PID:2320
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 164
        3⤵
        • Program crash
        PID:1508
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1672 -ip 1672
    1⤵
      PID:2992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3924 -ip 3924
      1⤵
        PID:2888
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3924 -ip 3924
        1⤵
          PID:2792

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

          Filesize

          274KB

          MD5

          fa6b4b4c79c9275bc7244e9d88d84eb8

          SHA1

          45b1ab5475f67c39edcfdff69bc9ebd3baebee8b

          SHA256

          6994b8a199a0fd927794eeef7ced3ca051626348641c9a7b6ae90468a72cc686

          SHA512

          5ec215391041b11277351c8aa9d72266939c74d5d0450770a52367303762529f73a36e876e2687797ef09c9328e6dbc22c7b50792c1edecf511bab309d837719

        • memory/1672-0-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB

        • memory/1672-7-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB

        • memory/3924-8-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB

        • memory/3924-10-0x0000000000400000-0x0000000000452000-memory.dmp

          Filesize

          328KB