Analysis
-
max time kernel
92s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 13:49
Static task
static1
Behavioral task
behavioral1
Sample
c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
-
Size
274KB
-
MD5
c919c9ef84f0b40869cc1bcf5d981fe0
-
SHA1
3c99b304f3030c99a71e7e785d52370d78ba428f
-
SHA256
1bd56a7fc8529a986b6276bd4eaafce486f4f70c78d8db73df642c84b2c3dc3c
-
SHA512
9316ae9fa6ab089f61900c1bce7e435b85b381b72ce66fed6e3f2dbedc5f2f12f31150f9893c7bbb0f30c783c51c7e2dbb142cf587010d1c367dba5334aefc0a
-
SSDEEP
6144:OULSmaOpn+0msBj1ud892ZXneB7FKNzYW0xfsLP:OUL9aO40msBjQd89U3eruufm
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3924 c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 3924 c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 3620 1672 WerFault.exe 81 2320 3924 WerFault.exe 89 1508 3924 WerFault.exe 89 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1672 c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1672 wrote to memory of 3924 1672 c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe 89 PID 1672 wrote to memory of 3924 1672 c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe 89 PID 1672 wrote to memory of 3924 1672 c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 4002⤵
- Program crash
PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 3683⤵
- Program crash
PID:2320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1643⤵
- Program crash
PID:1508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1672 -ip 16721⤵PID:2992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3924 -ip 39241⤵PID:2888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3924 -ip 39241⤵PID:2792
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274KB
MD5fa6b4b4c79c9275bc7244e9d88d84eb8
SHA145b1ab5475f67c39edcfdff69bc9ebd3baebee8b
SHA2566994b8a199a0fd927794eeef7ced3ca051626348641c9a7b6ae90468a72cc686
SHA5125ec215391041b11277351c8aa9d72266939c74d5d0450770a52367303762529f73a36e876e2687797ef09c9328e6dbc22c7b50792c1edecf511bab309d837719